Add an optional site password for visitors

Settings → Privacy can set a password for the whole public site. Until a
visitor enters it, every public page shows a prompt over a blurred
made-up page, and images, preview clips and exports return 401; nothing
real is sent. Unlocking sets a 90-day cookie derived from the password
hash, so changing the password asks everyone again. The owner is never
asked while signed in. Wrong guesses are rate limited, and a locked site
sends noindex.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/server.go

@@ -104,11 +104,12 @@ func (s *Server) Handler() http.Handler {
 	mux := http.NewServeMux()
 
 	// Public
-	mux.HandleFunc("GET /{$}", s.handleHome)
-	mux.HandleFunc("GET /l/{slug}", s.handleList)
-	mux.HandleFunc("GET /l/{slug}/export", s.handleExport)
-	mux.HandleFunc("GET /preview/{id}", s.handleItemPreview)
-	mux.HandleFunc("GET /images/{name}", s.handleImage)
+	mux.HandleFunc("GET /{$}", s.gated(s.handleHome))
+	mux.HandleFunc("GET /l/{slug}", s.gated(s.handleList))
+	mux.HandleFunc("GET /l/{slug}/export", s.gatedAsset(s.handleExport))
+	mux.HandleFunc("GET /preview/{id}", s.gatedAsset(s.handleItemPreview))
+	mux.HandleFunc("GET /images/{name}", s.gatedAsset(s.handleImage))
+	mux.HandleFunc("POST /unlock", s.handleUnlock)
 	mux.HandleFunc("GET /custom.css", s.handleCustomCSS)
 	mux.Handle("GET /static/", http.StripPrefix("/static/", s.staticHandler()))
 	mux.HandleFunc("GET /favicon.ico", func(w http.ResponseWriter, r *http.Request) {
@@ -151,6 +152,7 @@ func (s *Server) Handler() http.Handler {
 	api("DELETE /api/settings/avatar", s.apiDeleteAvatar)
 	api("POST /api/integrations/test", s.apiTestIntegration)
 	api("PUT /api/account", s.apiUpdateAccount)
+	api("PUT /api/site-password", s.apiSitePassword)
 	api("GET /api/backups", s.apiBackups)
 	api("POST /api/backups", s.apiCreateBackup)
 	api("PUT /api/backups/schedule", s.apiBackupSchedule)