Show management links and a signed-in indicator when logged in

Add GET /api/session, an unguarded probe that reports whether the request
carries valid credentials. It returns 200 with {"authenticated":bool} and never
sends WWW-Authenticate, so the static public pages can check login state without
triggering the browser's Basic-auth dialog. To keep it from being a
password-guessing oracle that bypasses the /upload limiter, a request with no
credentials is answered cheaply as false, while wrong credentials go through the
same failed-attempt limiter (429 once drained).

static/session.js, loaded by every page template, calls it and, only when
authenticated, builds a fixed toolbar: Upload / Manage links, an "Edit this"
link on photo pages (via <body data-slug>, deep-linking to /manage?edit=<slug>,
which scrolls to and focuses that row), a signed-in indicator, and a log-out
control. Logged-out visitors see nothing and get no dialog.

Log out is best-effort: HTTP Basic has no reliable sign-out (the browser caches
credentials until the window closes), so it overwrites the cached credential and
reloads, which works in some browsers but not all. A dependable logout would
need cookie sessions.

templates/photo.html

@@ -35,7 +35,7 @@
   {{if .Older}}<link rel="prefetch" href="/photo/{{.Older.Slug}}/">
   <link rel="prefetch" as="image" href="/{{.Older.Medium}}">{{end}}
 </head>
-<body>
+<body data-slug="{{.Photo.Slug}}">
   <div class="photo-page">
     <nav class="photo-nav">
       <a href="/" class="back-btn">← Back</a>
@@ -73,5 +73,6 @@
   </footer>
 
   <script src="/static/photo-nav.js" defer></script>
+  <script src="/static/session.js"></script>
 </body>
 </html>