feat: replace admin auth with cookie-based profile picker

Remove all authentication (login, sessions, bcrypt, itsdangerous) since
the app runs on a private homelab LAN. Replace with a profile picker
landing page and cookie-based profile selection (1-year expiry).

- Add Alembic migration to drop password_hash/is_admin columns
- Delete auth service, auth routes, login template, and auth tests
- Rewrite app/utils/auth.py with NoProfileSelectedError and
  require_active_profile dependency
- Add profile creation flow (GET/POST /profiles/create)
- Rewrite home page as profile picker with card layout
- Update all route files to use profile dependency instead of admin auth
- Remove bcrypt and itsdangerous from requirements
- Remove admin_username/admin_password from config
- Update all tests for new profile-based access model

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_log_service.py

@@ -21,7 +21,7 @@ class TestLogService:
         SQLModel.metadata.create_all(engine)
         session = Session(engine)
 
-        user = User(username="phil", password_hash="h", display_name="Phillip")
+        user = User(username="phil", display_name="Phillip")
         day = WorkoutDay(name="Push", day_number=1, description="Push day")
         exercise = Exercise(
             name="DB Chest Press", muscle_group="Chest",