Add endpoint tests with httptest

Two small refactors make the handlers testable:
- extract route registration into routes() http.Handler (was inline in main)
- initDB(dsn) takes a DSN so tests use an isolated temp-file DB

loginJitter var lets tests disable the anti-timing sleep for speed.

endpoints_test.go covers the main flows via httptest + cookie jar:
register/login/headerbar, empty-then-populated feed, create requires auth,
voting (new/toggle/switch, per-user tallies), vote auth + invalid mode,
and account deletion (wrong/correct password, login fails after).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

main.go

@@ -10,11 +10,19 @@ import (
 )
 
 func main() {
-	if err := initDB(); err != nil {
+	if err := initDB("kver.db"); err != nil {
 		log.Fatalf("db init: %v", err)
 	}
 	defer db.Close()
 
+	const addr = ":8080"
+	log.Printf("kver listening on %s", addr)
+	log.Fatal(http.ListenAndServe(addr, routes()))
+}
+
+// routes baut den HTTP-Handler mit allen Endpunkten. In main() und in den
+// Tests identisch verwendet.
+func routes() http.Handler {
 	r := chi.NewRouter()
 	r.Use(middleware.Logger)
 	r.Use(middleware.Recoverer)
@@ -48,9 +56,7 @@ func main() {
 	// Neues JS-Frontend
 	r.Handle("/*", http.FileServer(http.Dir("web")))
 
-	const addr = ":8080"
-	log.Printf("kver listening on %s", addr)
-	log.Fatal(http.ListenAndServe(addr, r))
+	return r
 }
 
 func writeJSON(w http.ResponseWriter, status int, v any) {