chore(backend): vendor htmx 2.0.4 and add WEB_PASSWORD config

backend/main.go

@@ -18,6 +18,8 @@ type Config struct {
 	AllowedOrigins []string
 	DBPath         string
 	Port           string
+	// WebPassword gates the browser UI. Empty disables the web routes entirely.
+	WebPassword string
 }
 
 func envOr(key, def string) string {
@@ -29,9 +31,10 @@ func envOr(key, def string) string {
 
 func loadConfig() Config {
 	c := Config{
-		Token:  os.Getenv("API_TOKEN"),
-		DBPath: envOr("DB_PATH", "/data/bookmarks.db"),
-		Port:   envOr("PORT", "8080"),
+		Token:       os.Getenv("API_TOKEN"),
+		DBPath:      envOr("DB_PATH", "/data/bookmarks.db"),
+		Port:        envOr("PORT", "8080"),
+		WebPassword: os.Getenv("WEB_PASSWORD"),
 	}
 	for _, o := range strings.Split(os.Getenv("ALLOWED_ORIGINS"), ",") {
 		if o = strings.TrimSpace(o); o != "" {