Add endpoint tests with httptest

Two small refactors make the handlers testable:
- extract route registration into routes() http.Handler (was inline in main)
- initDB(dsn) takes a DSN so tests use an isolated temp-file DB

loginJitter var lets tests disable the anti-timing sleep for speed.

endpoints_test.go covers the main flows via httptest + cookie jar:
register/login/headerbar, empty-then-populated feed, create requires auth,
voting (new/toggle/switch, per-user tallies), vote auth + invalid mode,
and account deletion (wrong/correct password, login fails after).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

db.go

@@ -45,9 +45,9 @@ CREATE TABLE IF NOT EXISTS vote (
 );
 `
 
-func initDB() error {
+func initDB(dsn string) error {
 	var err error
-	db, err = sql.Open("sqlite", "kver.db")
+	db, err = sql.Open("sqlite", dsn)
 	if err != nil {
 		return err
 	}