feat: replace admin auth with cookie-based profile picker

Remove all authentication (login, sessions, bcrypt, itsdangerous) since
the app runs on a private homelab LAN. Replace with a profile picker
landing page and cookie-based profile selection (1-year expiry).

- Add Alembic migration to drop password_hash/is_admin columns
- Delete auth service, auth routes, login template, and auth tests
- Rewrite app/utils/auth.py with NoProfileSelectedError and
  require_active_profile dependency
- Add profile creation flow (GET/POST /profiles/create)
- Rewrite home page as profile picker with card layout
- Update all route files to use profile dependency instead of admin auth
- Remove bcrypt and itsdangerous from requirements
- Remove admin_username/admin_password from config
- Update all tests for new profile-based access model

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

alembic/versions/a1b2c3d4e5f6_remove_auth_columns.py

@@ -0,0 +1,37 @@
+"""remove auth columns from users
+
+Revision ID: a1b2c3d4e5f6
+Revises: 1855836abf6c
+Create Date: 2026-03-13
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+import sqlmodel
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'a1b2c3d4e5f6'
+down_revision: Union[str, Sequence[str], None] = '1855836abf6c'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Drop password_hash and is_admin columns, delete admin users."""
+    # Delete admin users before dropping the column
+    op.execute("DELETE FROM users WHERE is_admin = 1")
+
+    # SQLite requires table recreation for column drops
+    with op.batch_alter_table('users', schema=None) as batch_op:
+        batch_op.drop_column('password_hash')
+        batch_op.drop_column('is_admin')
+
+
+def downgrade() -> None:
+    """Re-add password_hash and is_admin columns."""
+    with op.batch_alter_table('users', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('password_hash', sa.String(), nullable=False, server_default=''))
+        batch_op.add_column(sa.Column('is_admin', sa.Boolean(), nullable=False, server_default='0'))