feat(accounts): implement user accounts, sessions, and dashboards

Introduce Stage 4 features to support multi-user accounts, cookie-based web sessions, and personal dashboards.

Changes include:
- Adding `/register` to bootstrap the first admin account and `/login`/`/logout` for session management.
- Creating a personal dashboard (`/app`) to display owned boxes, storage usage, and upload history.
- Implementing admin user management (`/admin/users`) for generating invite links and managing user states.
- Updating the bbolt database schema to store users, sessions, invites, and collections.
- Adding `golang.org/x/crypto` for password hashing and introducing unit tests for account handlers.

backend/templates/pages/auth.html

@@ -0,0 +1,43 @@
+{{define "auth.html"}}{{template "base" .}}{{end}}
+
+{{define "content"}}
+<section class="auth-view" aria-labelledby="auth-title">
+  <div class="card auth-card">
+    <div class="card-content">
+      {{if eq .Data.Mode "register"}}
+        <p class="kicker">Instance bootstrap</p>
+        <h1 id="auth-title">Create the admin account</h1>
+        <p class="muted-copy">The first user becomes the instance admin. Registration closes after this account is created.</p>
+        <form class="stack-form" action="/register" method="post">
+          {{if .Data.Error}}<p class="form-error">{{.Data.Error}}</p>{{end}}
+          <label><span>Username</span><input name="username" autocomplete="username" required></label>
+          <label><span>Email</span><input type="email" name="email" autocomplete="email" required></label>
+          <label><span>Password</span><input type="password" name="password" autocomplete="new-password" minlength="8" required></label>
+          <button class="button button-primary" type="submit">Create admin</button>
+        </form>
+      {{else if eq .Data.Mode "invite"}}
+        <p class="kicker">{{if .Data.IsReset}}Password reset{{else}}Invite{{end}}</p>
+        <h1 id="auth-title">{{if .Data.IsReset}}Choose a new password{{else}}Create your account{{end}}</h1>
+        {{if .Data.Email}}<p class="muted-copy">{{.Data.Email}}</p>{{end}}
+        <form class="stack-form" action="/invite/{{.Data.Token}}" method="post">
+          {{if .Data.Error}}<p class="form-error">{{.Data.Error}}</p>{{end}}
+          {{if not .Data.IsReset}}<label><span>Username</span><input name="username" autocomplete="username" required></label>{{end}}
+          <label><span>Password</span><input type="password" name="password" autocomplete="new-password" minlength="8" required></label>
+          <button class="button button-primary" type="submit">Accept invite</button>
+        </form>
+      {{else}}
+        <p class="kicker">Account</p>
+        <h1 id="auth-title">Sign in</h1>
+        <form class="stack-form" action="/login" method="post">
+          {{if .Data.Error}}<p class="form-error">{{.Data.Error}}</p>{{end}}
+          <input type="hidden" name="next" value="{{.Data.ReturnPath}}">
+          <label><span>Email</span><input type="email" name="email" autocomplete="email" required></label>
+          <label><span>Password</span><input type="password" name="password" autocomplete="current-password" required></label>
+          <button class="button button-primary" type="submit">Sign in</button>
+        </form>
+      {{end}}
+      <p class="auth-alt"><a href="/">Back to upload</a></p>
+    </div>
+  </div>
+</section>
+{{end}}