Add an optional site password for visitors

Settings → Privacy can set a password for the whole public site. Until a
visitor enters it, every public page shows a prompt over a blurred
made-up page, and images, preview clips and exports return 401; nothing
real is sent. Unlocking sets a 90-day cookie derived from the password
hash, so changing the password asks everyone again. The owner is never
asked while signed in. Wrong guesses are rate limited, and a locked site
sends noindex.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/render.go

@@ -32,6 +32,7 @@ type Site struct {
 type pageData struct {
 	Site      Site
 	PageTitle string
+	Page      string // template name
 	LoggedIn  bool
 	Username  string
 	Path      string
@@ -195,6 +196,7 @@ func (s *Server) render(w http.ResponseWriter, r *http.Request, status int, page
 	pd := pageData{
 		Site:      s.site(r.Context()),
 		PageTitle: title,
+		Page:      page,
 		Path:      r.URL.Path,
 		AssetVer:  s.assetVer,
 		Data:      data,