feat(web): Sessions, Rate-Limiting, Security-Header, Templates und eingebettete Assets

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NBHF4R9EAejDJUMdwr6C68

internal/web/templates/login.html

@@ -0,0 +1,20 @@
+{{define "content"}}
+<h1>{{t "login_title"}}</h1>
+<form method="post" action="/login" class="card form" autocomplete="on">
+  <label for="username">{{t "login_username"}}</label>
+  <input type="text" id="username" name="username" required autofocus
+         autocomplete="username" autocapitalize="none" spellcheck="false"
+         aria-describedby="username-hint">
+  <small id="username-hint">{{t "login_username_hint"}}</small>
+
+  <label for="password">{{t "login_password"}}</label>
+  <input type="password" id="password" name="password" required autocomplete="current-password">
+  <div class="toggle-wrap" hidden id="toggle-wrap">
+    <input type="checkbox" id="show-password">
+    <label for="show-password">{{t "login_show_password"}}</label>
+  </div>
+
+  <button type="submit">{{t "login_submit"}}</button>
+</form>
+<script src="/assets/app.js" defer></script>
+{{end}}