feat: replace admin auth with cookie-based profile picker

Remove all authentication (login, sessions, bcrypt, itsdangerous) since
the app runs on a private homelab LAN. Replace with a profile picker
landing page and cookie-based profile selection (1-year expiry).

- Add Alembic migration to drop password_hash/is_admin columns
- Delete auth service, auth routes, login template, and auth tests
- Rewrite app/utils/auth.py with NoProfileSelectedError and
  require_active_profile dependency
- Add profile creation flow (GET/POST /profiles/create)
- Rewrite home page as profile picker with card layout
- Update all route files to use profile dependency instead of admin auth
- Remove bcrypt and itsdangerous from requirements
- Remove admin_username/admin_password from config
- Update all tests for new profile-based access model

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/config.py

@@ -20,8 +20,6 @@ class Settings(BaseSettings):
     """Typed application settings loaded from environment variables.
 
     Attributes:
-        admin_username: Admin login username (from ADMIN_USERNAME env var).
-        admin_password: Admin login password (from ADMIN_PASSWORD env var).
         app_env: Runtime environment — 'development' or 'production'.
         app_host: Host address to bind the server to.
         app_port: Port number for the server.
@@ -29,8 +27,6 @@ class Settings(BaseSettings):
         database_url: SQLite connection string.
     """
 
-    admin_username: str
-    admin_password: str
     app_env: str = "development"
     app_host: str = "0.0.0.0"
     app_port: int = 8000
@@ -40,6 +36,7 @@ class Settings(BaseSettings):
     model_config = SettingsConfigDict(
         env_file=".env",
         env_file_encoding="utf-8",
+        extra="ignore",
     )