Add lightweight self-hosted Hugo CMS with GitHub API backend

Implements a Go-based CMS for editing Hugo posts and uploading images
via the GitHub REST API, with no database and Git as the source of truth.

Features:
- Single admin auth with bcrypt password and signed session cookies
- Dashboard, post listing with search, create/edit with EasyMDE editor
- Media library for static/uploads/ with drag-drop and clipboard paste
- Client-side autosave, unsaved changes warning, dark mode, responsive UI
- Modular packages for auth, github, posts, media, session, and handlers

Co-authored-by: codegirl007 <s.raide@gmail.com>

cms/internal/auth/auth.go

@@ -0,0 +1,43 @@
+package auth
+
+import (
+	"errors"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+// Authenticator verifies admin credentials.
+type Authenticator struct {
+	username     string
+	passwordHash string
+}
+
+// New creates an Authenticator with the given credentials.
+func New(username, passwordHash string) *Authenticator {
+	return &Authenticator{
+		username:     username,
+		passwordHash: passwordHash,
+	}
+}
+
+// Verify checks username and password against stored credentials.
+func (a *Authenticator) Verify(username, password string) error {
+	if username != a.username {
+		return errors.New("invalid credentials")
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(a.passwordHash), []byte(password)); err != nil {
+		return errors.New("invalid credentials")
+	}
+
+	return nil
+}
+
+// HashPassword generates a bcrypt hash suitable for ADMIN_PASSWORD_HASH.
+func HashPassword(password string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+	return string(hash), nil
+}