feat: replace admin auth with cookie-based profile picker

Remove all authentication (login, sessions, bcrypt, itsdangerous) since
the app runs on a private homelab LAN. Replace with a profile picker
landing page and cookie-based profile selection (1-year expiry).

- Add Alembic migration to drop password_hash/is_admin columns
- Delete auth service, auth routes, login template, and auth tests
- Rewrite app/utils/auth.py with NoProfileSelectedError and
  require_active_profile dependency
- Add profile creation flow (GET/POST /profiles/create)
- Rewrite home page as profile picker with card layout
- Update all route files to use profile dependency instead of admin auth
- Remove bcrypt and itsdangerous from requirements
- Remove admin_username/admin_password from config
- Update all tests for new profile-based access model

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/routes/dashboard.py

@@ -15,7 +15,7 @@ from app.models.user import User
 from app.services.analytics_service import AnalyticsService
 from app.services.exercise_service import ExerciseService
 from app.services.progression_service import ProgressionService
-from app.utils.auth import get_current_admin_user, get_active_profile_id
+from app.utils.auth import require_active_profile
 
 logger = structlog.get_logger(__name__)
 
@@ -26,25 +26,12 @@ router = APIRouter(prefix="/dashboard", tags=["dashboard"])
 async def dashboard(
     request: Request,
     session: Session = Depends(get_db_session),
-    admin: User = Depends(get_current_admin_user),
+    profile: User = Depends(require_active_profile),
 ):
-    """Render the progress dashboard for the active profile.
-
-    Shows: summary stats, volume by day chart, exercise progress links.
-    """
-    active_profile_id = get_active_profile_id(request)
-    active_profile = (
-        session.get(User, active_profile_id)
-        if active_profile_id
-        else None
-    )
-
-    stats = {}
-    volume_data = {}
-    if active_profile_id:
-        analytics = AnalyticsService(session)
-        stats = analytics.get_user_stats(active_profile_id)
-        volume_data = analytics.get_volume_by_day(active_profile_id)
+    """Render the progress dashboard for the active profile."""
+    analytics = AnalyticsService(session)
+    stats = analytics.get_user_stats(profile.id)
+    volume_data = analytics.get_volume_by_day(profile.id)
 
     exercise_service = ExerciseService(session)
     exercises = exercise_service.list_exercises()
@@ -55,8 +42,7 @@ async def dashboard(
         "stats": stats,
         "volume_data_json": json.dumps(volume_data),
         "exercises": exercises,
-        "active_profile": active_profile,
-        "admin": admin,
+        "active_profile": profile,
     })
 
 
@@ -65,31 +51,21 @@ async def exercise_progress(
     exercise_id: int,
     request: Request,
     session: Session = Depends(get_db_session),
-    admin: User = Depends(get_current_admin_user),
+    profile: User = Depends(require_active_profile),
 ):
     """Render per-exercise progress page with charts and suggestions."""
-    active_profile_id = get_active_profile_id(request)
-    active_profile = (
-        session.get(User, active_profile_id)
-        if active_profile_id
-        else None
-    )
-
     exercise_service = ExerciseService(session)
     exercise = exercise_service.get_exercise_by_id(exercise_id)
 
-    progress_data = {}
-    suggestion = {}
-    if active_profile_id:
-        analytics = AnalyticsService(session)
-        progress_data = analytics.get_exercise_progress(
-            active_profile_id, exercise_id,
-        )
+    analytics = AnalyticsService(session)
+    progress_data = analytics.get_exercise_progress(
+        profile.id, exercise_id,
+    )
 
-        progression = ProgressionService(session)
-        suggestion = progression.get_suggestion(
-            active_profile_id, exercise_id,
-        )
+    progression = ProgressionService(session)
+    suggestion = progression.get_suggestion(
+        profile.id, exercise_id,
+    )
 
     templates = request.app.state.templates
     return templates.TemplateResponse("pages/exercise_progress.html", {
@@ -97,6 +73,5 @@ async def exercise_progress(
         "exercise": exercise,
         "progress_data_json": json.dumps(progress_data),
         "suggestion": suggestion,
-        "active_profile": active_profile,
-        "admin": admin,
+        "active_profile": profile,
     })