feat(accounts): implement user accounts, sessions, and dashboards

Introduce Stage 4 features to support multi-user accounts, cookie-based web sessions, and personal dashboards.

Changes include:
- Adding `/register` to bootstrap the first admin account and `/login`/`/logout` for session management.
- Creating a personal dashboard (`/app`) to display owned boxes, storage usage, and upload history.
- Implementing admin user management (`/admin/users`) for generating invite links and managing user states.
- Updating the bbolt database schema to store users, sessions, invites, and collections.
- Adding `golang.org/x/crypto` for password hashing and introducing unit tests for account handlers.

backend/templates/pages/account.html

@@ -0,0 +1,19 @@
+{{define "account.html"}}{{template "base" .}}{{end}}
+
+{{define "content"}}
+<section class="auth-view" aria-labelledby="account-title">
+  <div class="card auth-card">
+    <div class="card-content">
+      <p class="kicker">Account</p>
+      <h1 id="account-title">Settings</h1>
+      <p class="muted-copy">{{.Data.Email}} · {{.Data.Role}}</p>
+      <form class="stack-form" action="/account/password" method="post">
+        <label><span>Current password</span><input type="password" name="current_password" autocomplete="current-password" required></label>
+        <label><span>New password</span><input type="password" name="new_password" autocomplete="new-password" minlength="8" required></label>
+        <button class="button button-primary" type="submit">Update password</button>
+      </form>
+      <p class="muted-copy">Public forgot-password is deferred until SMTP support is added. Admins can generate reset links.</p>
+    </div>
+  </div>
+</section>
+{{end}}