Phase 1.2: session login + empty HTMX dashboard

- Session login for the single user Sam: server-side session store with an
  HMAC-signed session cookie, POST /login, POST /logout, and double-submit
  CSRF on every form post. Unauthenticated requests to / and /partials/*
  redirect to /login?next=...
- Empty dashboard shell in the Family Home Lab design system: left nav
  (category and folder placeholders), centre list, right detail pane.
- Copy tokens.css and the self-hosted Inter fonts from the family-home-lab
  design system into web/static; vendor htmx 2.0.4. No cross-project imports
  at runtime.
- Dark mode via prefers-color-scheme plus a persisted toggle; phone-first
  layout with 44px touch targets, hairline borders, 8px grid, pill CTAs.
- Config: EMAIL_AGENT_PASSWORD for the login password, falling back to
  EMAIL_AGENT_SESSION_SECRET so one configured secret is enough.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

web/embed.go

@@ -0,0 +1,23 @@
+// Package web holds the server-rendered templates and static assets for the
+// Email Agent UI.
+//
+// The assets are embedded in the binary so the container image needs no
+// separate file tree and cannot drift from the code.
+//
+// tokens.css and the Inter woff2 files are copied verbatim from the Family Home
+// Lab design system (AGENTS.md §6); they are compiled into this project rather
+// than imported across projects.
+package web
+
+import "embed"
+
+// StaticFS holds the /static tree: design tokens, self-hosted Inter fonts,
+// htmx, and the application stylesheet.
+//
+//go:embed static
+var StaticFS embed.FS
+
+// TemplateFS holds the server-rendered HTML templates.
+//
+//go:embed templates
+var TemplateFS embed.FS