Move upload auth from nginx into the app

Add HTTP Basic auth on /upload, reading an Apache htpasswd file (bcrypt
only, `htpasswd -B`) via a new -htpasswd flag. This lets nginx drop to a
plain TLS-terminating reverse proxy with no auth of its own; the existing
bcrypt htpasswd file is reused unchanged.

auth.go:
- LoadHtpasswd parses user:hash lines, keeps bcrypt entries ($2a/$2b/$2y,
  so Apache's $2y$ works), skips MD5/SHA/crypt with a warning.
- Unknown users still pay for one bcrypt comparison against a dummy hash,
  so response timing can't enumerate valid usernames.
- Failed attempts draw from a token-bucket limiter (x/time/rate, ~1/s,
  burst 10) returning 429 once drained; successful and bulk uploads never
  touch it.

server.go guards both /upload routes (nil authenticator = passthrough for
local --serve). /health stays open. Empty -htpasswd disables auth and logs
a warning.

module.nix: new top-level services.photogallery.htpasswdFile, delivered to
the service via systemd LoadCredential (so a root-owned 0400 secret works).
Removed nginx.htpasswdFile and basic_auth from the vhost.

Both uploader apps already send Basic credentials, so no client change.

Deps: golang.org/x/crypto/bcrypt, golang.org/x/time/rate (vendorHash bump).

main.go

@@ -20,6 +20,7 @@ func main() {
 	serifFamily := flag.String("serif-family", "Crimson Pro", "CSS font-family for the primary serif text")
 	mlFamily    := flag.String("ml-family", "Manjari", "CSS font-family for the alt-script (Malayalam) bio line")
 	pageSize    := flag.Int("page-size", 60, "photos per page on the timeline and grid views (timeline packs whole days, so pages vary slightly around this)")
+	htpasswd    := flag.String("htpasswd", "", "path to an htpasswd file (bcrypt, `htpasswd -B`) guarding /upload; empty disables auth")
 	flag.Parse()
 
 	for _, d := range []string{*contentDir, *outputDir} {
@@ -41,6 +42,17 @@ func main() {
 	defer w.Close()
 	go w.Watch()
 
-	s := NewServer(*port, *contentDir, *outputDir, *serve, g)
+	var auth *Authenticator
+	if *htpasswd != "" {
+		auth, err = LoadHtpasswd(*htpasswd)
+		if err != nil {
+			log.Fatalf("htpasswd: %v", err)
+		}
+		log.Printf("upload auth: enabled (%s)", *htpasswd)
+	} else {
+		log.Print("upload auth: DISABLED (no -htpasswd); /upload is open")
+	}
+
+	s := NewServer(*port, *contentDir, *outputDir, *serve, g, auth)
 	log.Fatal(s.Listen())
 }