Add HTTP Basic Auth

All write endpoints and the manage
routes are gated behind HTTP Basic Auth middleware; credentials are
configured via [auth] in config.toml or APP__AUTH__USERNAME /
APP__AUTH__PASSWORD environment variables.

config.example.toml

@@ -12,6 +12,13 @@ url = "sqlite://mikebase.db"
 host = "0.0.0.0"
 port = 3000
 
+[auth]
+# Credentials for the /manage UI and emote write endpoints (POST/PUT/DELETE).
+# Can also be set via APP__AUTH__USERNAME and APP__AUTH__PASSWORD env vars.
+# If omitted, all protected routes return 401.
+username = "admin"
+password = "changeme"
+
 [s3]
 endpoint = "https://s3.eu-central-1.wasabisys.com"
 region   = "eu-central-1"