Add site-wide login gate protecting the whole app

Chat/memory/logs/models APIs were reachable without any auth even
though the app is deployed publicly behind Caddy HTTPS; only the
settings screen had a password. Add an optional SITE_PASSWORD-backed
session cookie gate in front of everything (settings included, on
top of its existing SETTINGS_PASSWORD), with a matching login screen
on the frontend. Stays fully backward compatible: with SITE_PASSWORD
unset the app behaves exactly as before.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -107,3 +107,5 @@ SQLite (playchat.db) + LiteLLM → 任意の LLM
 | `OPENAI_API_KEY` | — | OpenAI API キー |
 | `ANTHROPIC_API_KEY` | — | Anthropic API キー |
 | `OLLAMA_API_BASE` | `http://localhost:11434` | Ollama エンドポイント |
+| `SITE_PASSWORD` | — | サイト全体を保護する共有パスワード（未設定なら無認証） |
+| `SESSION_SECRET_KEY` | 起動毎に自動生成 | ログインセッション Cookie の署名鍵 |