Harden auth: setup secret, throttling, session destroy, secure cookies.

Replace username-based admin bootstrap with a one-time setup secret, rate-limit login/register, equalize login bcrypt timing, cap passwords at 72 bytes, destroy sessions on logout, and require Secure cookies when PORT is set.

templates/register.html

@@ -10,8 +10,11 @@
     <input id="username" name="username" type="text" required minlength="3" maxlength="20" pattern="[A-Za-z0-9_]+" autocomplete="username" autocapitalize="off" spellcheck="false" value="{{.Username}}">
     <p class="hint">3–20 letters, numbers, or underscores.</p>
     <label for="password">Password</label>
-    <input id="password" name="password" type="password" required minlength="8" autocomplete="new-password">
-    <p class="hint">At least 8 characters.</p>
+    <input id="password" name="password" type="password" required minlength="8" maxlength="72" autocomplete="new-password">
+    <p class="hint">At least 8 characters (max 72 bytes).</p>
+    <label for="setup_secret">Setup secret <span class="hint">(optional, first install only)</span></label>
+    <input id="setup_secret" name="setup_secret" type="password" autocomplete="off">
+    <p class="hint">Only needed once to create the first admin. Leave blank otherwise.</p>
     <button type="submit" class="btn btn-primary">Create account</button>
   </form>
   <p class="switch">Already have an account? <a href="/login">Sign in</a></p>