Show management links and a signed-in indicator when logged in

Add GET /api/session, an unguarded probe that reports whether the request
carries valid credentials. It returns 200 with {"authenticated":bool} and never
sends WWW-Authenticate, so the static public pages can check login state without
triggering the browser's Basic-auth dialog. To keep it from being a
password-guessing oracle that bypasses the /upload limiter, a request with no
credentials is answered cheaply as false, while wrong credentials go through the
same failed-attempt limiter (429 once drained).

static/session.js, loaded by every page template, calls it and, only when
authenticated, builds a fixed toolbar: Upload / Manage links, an "Edit this"
link on photo pages (via <body data-slug>, deep-linking to /manage?edit=<slug>,
which scrolls to and focuses that row), a signed-in indicator, and a log-out
control. Logged-out visitors see nothing and get no dialog.

Log out is best-effort: HTTP Basic has no reliable sign-out (the browser caches
credentials until the window closes), so it overwrites the cached credential and
reloads, which works in some browsers but not all. A dependable logout would
need cookie sessions.

static/style.css

@@ -499,3 +499,27 @@ body {
   background: var(--bg2);
   color: var(--fg);
 }
+
+/* Session toolbar (session.js), shown on any page when signed in. */
+.session-bar {
+  position: fixed;
+  top: 0;
+  right: 0;
+  z-index: 60;
+  display: flex;
+  align-items: center;
+  gap: 14px;
+  padding: 7px 14px;
+  background: var(--bg1);
+  border-left: 1px solid var(--bg2);
+  border-bottom: 1px solid var(--bg2);
+  font-family: monospace;
+  font-size: 12px;
+}
+.session-bar a {
+  color: var(--aqua, #8ec07c);
+  text-decoration: none;
+}
+.session-bar a:hover { text-decoration: underline; }
+.session-dot { color: var(--green, #b8bb26); }
+.session-out { color: var(--fg4) !important; }