feat: replace admin auth with cookie-based profile picker

Remove all authentication (login, sessions, bcrypt, itsdangerous) since
the app runs on a private homelab LAN. Replace with a profile picker
landing page and cookie-based profile selection (1-year expiry).

- Add Alembic migration to drop password_hash/is_admin columns
- Delete auth service, auth routes, login template, and auth tests
- Rewrite app/utils/auth.py with NoProfileSelectedError and
  require_active_profile dependency
- Add profile creation flow (GET/POST /profiles/create)
- Rewrite home page as profile picker with card layout
- Update all route files to use profile dependency instead of admin auth
- Remove bcrypt and itsdangerous from requirements
- Remove admin_username/admin_password from config
- Update all tests for new profile-based access model

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_config.py

@@ -11,37 +11,17 @@ class TestSettings:
 
     def test_settings_loads_defaults(self) -> None:
         """Settings should have sensible defaults for all fields."""
-        env = {
-            "ADMIN_USERNAME": "testadmin",
-            "ADMIN_PASSWORD": "testpass123",
-        }
         # Remove DATABASE_URL so we test the actual default
         env_clean = {k: v for k, v in os.environ.items() if k != "DATABASE_URL"}
-        env_clean.update(env)
         with patch.dict(os.environ, env_clean, clear=True):
             settings = Settings()
-            assert settings.admin_username == "testadmin"
-            assert settings.admin_password == "testpass123"
             assert settings.app_env == "development"
             assert settings.app_host == "0.0.0.0"
             assert settings.app_port == 8000
             assert settings.database_url == "sqlite:///data/sneakyswole.db"
 
-    def test_settings_requires_admin_username(self) -> None:
-        """Settings should require ADMIN_USERNAME to be set."""
-        with patch.dict(os.environ, {"ADMIN_PASSWORD": "testpass"}, clear=True):
-            try:
-                Settings()
-                assert False, "Should have raised an error"
-            except Exception:
-                pass
-
     def test_get_settings_returns_singleton(self) -> None:
         """get_settings should return the same instance on repeated calls."""
-        with patch.dict(os.environ, {
-            "ADMIN_USERNAME": "admin",
-            "ADMIN_PASSWORD": "pass",
-        }, clear=False):
-            s1 = get_settings()
-            s2 = get_settings()
-            assert s1 is s2
+        s1 = get_settings()
+        s2 = get_settings()
+        assert s1 is s2