Rewrite backend in Go with JSON API and JS frontend

Reimplements the Flask app as a Go HTTP API (chi + modernc sqlite) with a
minimal vanilla-JS frontend in web/. Endpoints mirror the original Flask
routes but return JSON instead of HTML.

- auth: login/logout/register/sessioninfo/headerbar with crypto/rand tokens
- entry: paginated feed (single JOIN), create with image scaling
- user: profile, userinfo; delete still a stub
- requireAuth middleware passes uid via context
- notes/api.md documents the API and schema

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

middleware.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"context"
+	"net/http"
+)
+
+type ctxKey string
+
+const uidKey ctxKey = "uid"
+
+// requireAuth lehnt Anfragen ohne gültige Session ab und legt die uid in den Context.
+func requireAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		s, ok := getSession(r)
+		if !ok {
+			writeError(w, http.StatusUnauthorized, "Nicht angemeldet")
+			return
+		}
+		ctx := context.WithValue(r.Context(), uidKey, s.UID)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func uidFromContext(ctx context.Context) int64 {
+	uid, _ := ctx.Value(uidKey).(int64)
+	return uid
+}