feat: replace admin auth with cookie-based profile picker

Remove all authentication (login, sessions, bcrypt, itsdangerous) since
the app runs on a private homelab LAN. Replace with a profile picker
landing page and cookie-based profile selection (1-year expiry).

- Add Alembic migration to drop password_hash/is_admin columns
- Delete auth service, auth routes, login template, and auth tests
- Rewrite app/utils/auth.py with NoProfileSelectedError and
  require_active_profile dependency
- Add profile creation flow (GET/POST /profiles/create)
- Rewrite home page as profile picker with card layout
- Update all route files to use profile dependency instead of admin auth
- Remove bcrypt and itsdangerous from requirements
- Remove admin_username/admin_password from config
- Update all tests for new profile-based access model

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_logging_routes.py

@@ -6,8 +6,8 @@ from fastapi.testclient import TestClient
 class TestLogSet:
     """Tests for POST /log."""
 
-    def test_log_set_requires_auth(self, client: TestClient) -> None:
-        """POST /log should require admin login."""
+    def test_log_set_requires_profile(self, client: TestClient) -> None:
+        """POST /log should redirect to / without profile cookie."""
         response = client.post(
             "/log",
             data={
@@ -19,26 +19,29 @@ class TestLogSet:
             },
             follow_redirects=False,
         )
-        assert response.status_code in (401, 303)
+        assert response.status_code == 302
+        assert response.headers["location"] == "/"
 
 
 class TestLogEdit:
     """Tests for POST /log/<id>/edit."""
 
-    def test_edit_log_requires_auth(self, client: TestClient) -> None:
-        """POST /log/1/edit should require admin login."""
+    def test_edit_log_requires_profile(self, client: TestClient) -> None:
+        """POST /log/1/edit should redirect to / without profile cookie."""
         response = client.post(
             "/log/1/edit",
             data={"reps": "10", "weight": "35 lbs"},
             follow_redirects=False,
         )
-        assert response.status_code in (401, 303)
+        assert response.status_code == 302
+        assert response.headers["location"] == "/"
 
 
 class TestLogDelete:
     """Tests for POST /log/<id>/delete."""
 
-    def test_delete_log_requires_auth(self, client: TestClient) -> None:
-        """POST /log/1/delete should require admin login."""
+    def test_delete_log_requires_profile(self, client: TestClient) -> None:
+        """POST /log/1/delete should redirect to / without profile cookie."""
         response = client.post("/log/1/delete", follow_redirects=False)
-        assert response.status_code in (401, 303)
+        assert response.status_code == 302
+        assert response.headers["location"] == "/"