feat: replace admin auth with cookie-based profile picker

Remove all authentication (login, sessions, bcrypt, itsdangerous) since
the app runs on a private homelab LAN. Replace with a profile picker
landing page and cookie-based profile selection (1-year expiry).

- Add Alembic migration to drop password_hash/is_admin columns
- Delete auth service, auth routes, login template, and auth tests
- Rewrite app/utils/auth.py with NoProfileSelectedError and
  require_active_profile dependency
- Add profile creation flow (GET/POST /profiles/create)
- Rewrite home page as profile picker with card layout
- Update all route files to use profile dependency instead of admin auth
- Remove bcrypt and itsdangerous from requirements
- Remove admin_username/admin_password from config
- Update all tests for new profile-based access model

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_seed_service.py

@@ -1,9 +1,7 @@
 """Tests for the SeedService class."""
 
 from pathlib import Path
-from unittest.mock import patch
 
-import bcrypt
 from sqlmodel import SQLModel, Session, create_engine, select
 
 from app.models.user import User
@@ -53,20 +51,6 @@ class TestSeedService:
         assert len(warmups) == 6
         session.close()
 
-    def test_seed_admin_user(self) -> None:
-        """seed_admin should create admin user with hashed password."""
-        session, service = self._setup()
-        with patch.dict("os.environ", {
-            "ADMIN_USERNAME": "admin",
-            "ADMIN_PASSWORD": "testpass",
-        }):
-            service.seed_admin()
-        admin = session.exec(select(User).where(User.is_admin == True)).first()  # noqa: E712
-        assert admin is not None
-        assert admin.username == "admin"
-        assert bcrypt.checkpw(b"testpass", admin.password_hash.encode())
-        session.close()
-
     def test_seed_user_programs(self) -> None:
         """seed_user_programs should create user profiles and link exercises."""
         session, service = self._setup()
@@ -74,19 +58,15 @@ class TestSeedService:
         service.seed_user_programs()
         programs = session.exec(select(UserExerciseProgram)).all()
         assert len(programs) > 0
-        users = session.exec(select(User).where(User.is_admin == False)).all()  # noqa: E712
+        users = session.exec(select(User)).all()
         assert len(users) == 2  # Phillip and Daughter
         session.close()
 
     def test_seed_is_idempotent(self) -> None:
         """Running seed_all twice should not create duplicate records."""
         session, service = self._setup()
-        with patch.dict("os.environ", {
-            "ADMIN_USERNAME": "admin",
-            "ADMIN_PASSWORD": "testpass",
-        }):
-            service.seed_all()
-            service.seed_all()
+        service.seed_all()
+        service.seed_all()
         users = session.exec(select(User)).all()
         exercises = session.exec(select(Exercise)).all()
         # Should not be doubled