feat: replace admin auth with cookie-based profile picker

Remove all authentication (login, sessions, bcrypt, itsdangerous) since
the app runs on a private homelab LAN. Replace with a profile picker
landing page and cookie-based profile selection (1-year expiry).

- Add Alembic migration to drop password_hash/is_admin columns
- Delete auth service, auth routes, login template, and auth tests
- Rewrite app/utils/auth.py with NoProfileSelectedError and
  require_active_profile dependency
- Add profile creation flow (GET/POST /profiles/create)
- Rewrite home page as profile picker with card layout
- Update all route files to use profile dependency instead of admin auth
- Remove bcrypt and itsdangerous from requirements
- Remove admin_username/admin_password from config
- Update all tests for new profile-based access model

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/routes/history.py

@@ -13,7 +13,7 @@ from app.models.user import User
 from app.services.exercise_service import ExerciseService
 from app.services.log_service import LogService
 from app.services.workout_session_service import WorkoutSessionService
-from app.utils.auth import get_current_admin_user, get_active_profile_id
+from app.utils.auth import require_active_profile
 
 logger = structlog.get_logger(__name__)
 
@@ -24,31 +24,11 @@ router = APIRouter(prefix="/history", tags=["history"])
 async def log_history(
     request: Request,
     session: Session = Depends(get_db_session),
-    admin: User = Depends(get_current_admin_user),
+    profile: User = Depends(require_active_profile),
 ):
-    """Display log history for the active profile.
-
-    Shows a list of past workout sessions, most recent first.
-
-    Args:
-        request: The incoming HTTP request.
-        session: Database session.
-        admin: The authenticated admin user.
-
-    Returns:
-        Rendered log history page.
-    """
-    active_profile_id = get_active_profile_id(request)
-    active_profile = (
-        session.get(User, active_profile_id)
-        if active_profile_id
-        else None
-    )
-
-    sessions_list = []
-    if active_profile_id:
-        ws_service = WorkoutSessionService(session)
-        sessions_list = ws_service.list_sessions(user_id=active_profile_id)
+    """Display log history for the active profile."""
+    ws_service = WorkoutSessionService(session)
+    sessions_list = ws_service.list_sessions(user_id=profile.id)
 
     # Resolve workout day names for display
     exercise_service = ExerciseService(session)
@@ -59,8 +39,7 @@ async def log_history(
         "request": request,
         "sessions": sessions_list,
         "days_by_id": days_by_id,
-        "active_profile": active_profile,
-        "admin": admin,
+        "active_profile": profile,
     })
 
 
@@ -69,19 +48,9 @@ async def session_detail(
     session_id: int,
     request: Request,
     session: Session = Depends(get_db_session),
-    admin: User = Depends(get_current_admin_user),
+    profile: User = Depends(require_active_profile),
 ):
-    """Display detailed logs for a specific workout session.
-
-    Args:
-        session_id: The workout session ID.
-        request: The incoming HTTP request.
-        session: Database session.
-        admin: The authenticated admin user.
-
-    Returns:
-        Rendered session detail page.
-    """
+    """Display detailed logs for a specific workout session."""
     ws_service = WorkoutSessionService(session)
     ws = ws_service.get_session_by_id(session_id)
 
@@ -109,5 +78,4 @@ async def session_detail(
         "logs_by_exercise": logs_by_exercise,
         "exercises_by_id": exercises_by_id,
         "days_by_id": days_by_id,
-        "admin": admin,
     })