chore(backend): vendor htmx 2.0.4 and add WEB_PASSWORD config

backend/main.go

@@ -18,6 +18,8 @@ type Config struct {
 	AllowedOrigins []string
 	DBPath         string
 	Port           string
+	// WebPassword gates the browser UI. Empty disables the web routes entirely.
+	WebPassword string
 }
 
 func envOr(key, def string) string {
@@ -29,9 +31,10 @@ func envOr(key, def string) string {
 
 func loadConfig() Config {
 	c := Config{
-		Token:  os.Getenv("API_TOKEN"),
+		Token:       os.Getenv("API_TOKEN"),
-		DBPath: envOr("DB_PATH", "/data/bookmarks.db"),
+		DBPath:      envOr("DB_PATH", "/data/bookmarks.db"),
-		Port:   envOr("PORT", "8080"),
+		Port:        envOr("PORT", "8080"),
+		WebPassword: os.Getenv("WEB_PASSWORD"),
 	}
 	for _, o := range strings.Split(os.Getenv("ALLOWED_ORIGINS"), ",") {
 		if o = strings.TrimSpace(o); o != "" {

backend/store_test.go

@@ -515,3 +515,16 @@ func TestBookmarkContinueURL(t *testing.T) {
 		})
 	}
 }
+
+func TestLoadConfigWebPassword(t *testing.T) {
+	t.Setenv("API_TOKEN", "token-abc")
+	t.Setenv("WEB_PASSWORD", "hunter2")
+	if got := loadConfig().WebPassword; got != "hunter2" {
+		t.Fatalf("WebPassword = %q, want hunter2", got)
+	}
+
+	t.Setenv("WEB_PASSWORD", "")
+	if got := loadConfig().WebPassword; got != "" {
+		t.Fatalf("WebPassword = %q with the variable unset, want empty", got)
+	}
+}