Add HTTP Basic Auth

All write endpoints and the manage
routes are gated behind HTTP Basic Auth middleware; credentials are
configured via [auth] in config.toml or APP__AUTH__USERNAME /
APP__AUTH__PASSWORD environment variables.

CHANGELOG.md

@@ -14,6 +14,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `AdminEmoteResponse` model exposing `uuid` and `alias` fields not present in
   the public `EmoteResponse`.
 - Client-side search on the management page filtering emotes by name or alias.
+- HTTP Basic Auth middleware protecting `/manage` and all emote write endpoints
+  (`POST /emotes`, `PUT /emotes/{uuid}`, `DELETE /emotes/{uuid}`). Credentials
+  are configured via `[auth]` in `config.toml` or the `APP__AUTH__USERNAME` /
+  `APP__AUTH__PASSWORD` environment variables. Omitting the section causes all
+  protected routes to return 401.
 
 ## [0.2.4] - 2026-04-11