feat: replace admin auth with cookie-based profile picker

Remove all authentication (login, sessions, bcrypt, itsdangerous) since
the app runs on a private homelab LAN. Replace with a profile picker
landing page and cookie-based profile selection (1-year expiry).

- Add Alembic migration to drop password_hash/is_admin columns
- Delete auth service, auth routes, login template, and auth tests
- Rewrite app/utils/auth.py with NoProfileSelectedError and
  require_active_profile dependency
- Add profile creation flow (GET/POST /profiles/create)
- Rewrite home page as profile picker with card layout
- Update all route files to use profile dependency instead of admin auth
- Remove bcrypt and itsdangerous from requirements
- Remove admin_username/admin_password from config
- Update all tests for new profile-based access model

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/services/seed_service.py

@@ -4,11 +4,9 @@ Reads config/exercises.yaml and config/user_programs.yaml to populate
 the exercise library, warmups, workout days, and user programs.
 """
 
-import os
 from pathlib import Path
 from typing import Optional
 
-import bcrypt
 import structlog
 import yaml
 from sqlmodel import Session, select
@@ -43,14 +41,7 @@ class SeedService:
         self._config_dir = config_dir or Path(__file__).resolve().parent.parent.parent / "config"
 
     def _load_yaml(self, filename: str) -> dict:
-        """Load and parse a YAML file from the config directory.
-
-        Args:
-            filename: Name of the YAML file to load.
-
-        Returns:
-            Parsed YAML content as a dictionary.
-        """
+        """Load and parse a YAML file from the config directory."""
         filepath = self._config_dir / filename
         with open(filepath, "r") as f:
             return yaml.safe_load(f)
@@ -111,48 +102,8 @@ class SeedService:
         self._session.commit()
         logger.info("seed_complete", table="warmups", count=len(warmups))
 
-    def seed_admin(self) -> None:
-        """Create admin user from environment variables if not exists.
-
-        Reads ADMIN_USERNAME and ADMIN_PASSWORD from env,
-        hashes the password with bcrypt, and creates the admin user.
-        """
-        admin_username = os.environ.get("ADMIN_USERNAME", "admin")
-        admin_password = os.environ.get("ADMIN_PASSWORD", "")
-
-        existing = self._session.exec(
-            select(User).where(User.username == admin_username)
-        ).first()
-        if existing:
-            logger.info("seed_skipped", table="users", reason="admin already exists")
-            return
-
-        if not admin_password:
-            logger.warning("seed_skipped", table="users", reason="ADMIN_PASSWORD not set")
-            return
-
-        # Hash password with bcrypt
-        password_hash = bcrypt.hashpw(
-            admin_password.encode("utf-8"),
-            bcrypt.gensalt(),
-        ).decode("utf-8")
-
-        admin = User(
-            username=admin_username,
-            password_hash=password_hash,
-            display_name="Admin",
-            is_admin=True,
-        )
-        self._session.add(admin)
-        self._session.commit()
-        logger.info("seed_complete", table="users", user="admin")
-
     def seed_user_programs(self) -> None:
-        """Seed user profiles and their exercise programs from user_programs.yaml.
-
-        Creates non-admin user profiles and links them to exercises
-        with week 1/4 rep and weight targets.
-        """
+        """Seed user profiles and their exercise programs from user_programs.yaml."""
         data = self._load_yaml("user_programs.yaml")
         programs = data.get("programs", [])
 
@@ -172,12 +123,10 @@ class SeedService:
             else:
                 user = User(
                     username=username,
-                    password_hash="",  # Non-admin users don't log in initially
                     display_name=display_name,
                     height=profile.get("height", ""),
                     weight=profile.get("weight", ""),
                     goals=profile.get("goals", ""),
-                    is_admin=False,
                 )
                 self._session.add(user)
                 self._session.commit()
@@ -219,15 +168,10 @@ class SeedService:
             logger.info("seed_complete", table="user_exercise_programs", user=username)
 
     def seed_all(self) -> None:
-        """Run all seed operations in the correct order.
-
-        Order matters: workout_days and exercises must exist before
-        user_programs can reference them.
-        """
+        """Run all seed operations in the correct order."""
         logger.info("seed_all_started")
         self.seed_workout_days()
         self.seed_exercises()
         self.seed_warmups()
-        self.seed_admin()
         self.seed_user_programs()
         logger.info("seed_all_complete")