feat: replace admin auth with cookie-based profile picker

Remove all authentication (login, sessions, bcrypt, itsdangerous) since
the app runs on a private homelab LAN. Replace with a profile picker
landing page and cookie-based profile selection (1-year expiry).

- Add Alembic migration to drop password_hash/is_admin columns
- Delete auth service, auth routes, login template, and auth tests
- Rewrite app/utils/auth.py with NoProfileSelectedError and
  require_active_profile dependency
- Add profile creation flow (GET/POST /profiles/create)
- Rewrite home page as profile picker with card layout
- Update all route files to use profile dependency instead of admin auth
- Remove bcrypt and itsdangerous from requirements
- Remove admin_username/admin_password from config
- Update all tests for new profile-based access model

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/models/user.py

@@ -1,6 +1,6 @@
 """User model for profile management.
 
-Stores admin and regular user profiles with physical stats and goals.
+Stores user profiles with physical stats and goals.
 """
 
 from datetime import datetime
@@ -14,13 +14,11 @@ class User(SQLModel, table=True):
 
     Attributes:
         id: Primary key, auto-incremented.
-        username: Unique login identifier.
-        password_hash: bcrypt-hashed password (admin only initially).
+        username: Unique identifier.
         display_name: Human-readable name shown in the UI.
         height: User's height as a string (e.g., "6'0\"").
         weight: User's weight as a string (e.g., "260 lbs").
         goals: Free-text training goals.
-        is_admin: Whether this user has admin privileges.
         created_at: Timestamp when the record was created.
         updated_at: Timestamp of the last update.
     """
@@ -29,11 +27,9 @@ class User(SQLModel, table=True):
 
     id: Optional[int] = Field(default=None, primary_key=True)
     username: str = Field(index=True, unique=True)
-    password_hash: str = Field(default="")
     display_name: str = Field(default="")
     height: Optional[str] = Field(default=None)
     weight: Optional[str] = Field(default=None)
     goals: Optional[str] = Field(default=None)
-    is_admin: bool = Field(default=False)
     created_at: datetime = Field(default_factory=datetime.utcnow)
     updated_at: datetime = Field(default_factory=datetime.utcnow)