Add site-wide login gate protecting the whole app

Chat/memory/logs/models APIs were reachable without any auth even
though the app is deployed publicly behind Caddy HTTPS; only the
settings screen had a password. Add an optional SITE_PASSWORD-backed
session cookie gate in front of everything (settings included, on
top of its existing SETTINGS_PASSWORD), with a matching login screen
on the frontend. Stays fully backward compatible: with SITE_PASSWORD
unset the app behaves exactly as before.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/main.py

@@ -1,14 +1,16 @@
 import asyncio
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI
+from fastapi import Depends, FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
+from app.api import auth as auth_api
 from app.api import chat, logs, memory, system
 from app.api import models as models_api
 from app.api import settings as settings_api
 from app.core import settings_store
 from app.core.config import CORS_ORIGINS
+from app.core.site_auth import require_site_session
 from app.core.discord.discord_bot import start_discord_bot
 from app.core.discord.scheduler import start_scheduler
 from app.core.memory_kb.word_memory import seed_from_history
@@ -88,12 +90,13 @@ app.add_middleware(
 )
 
 
-app.include_router(chat.router)
-app.include_router(memory.router)
-app.include_router(logs.router)
-app.include_router(system.router)
-app.include_router(settings_api.router)
-app.include_router(models_api.router)
+app.include_router(auth_api.router)
+app.include_router(chat.router, dependencies=[Depends(require_site_session)])
+app.include_router(memory.router, dependencies=[Depends(require_site_session)])
+app.include_router(logs.router, dependencies=[Depends(require_site_session)])
+app.include_router(system.router, dependencies=[Depends(require_site_session)])
+app.include_router(settings_api.router, dependencies=[Depends(require_site_session)])
+app.include_router(models_api.router, dependencies=[Depends(require_site_session)])
 
 
 @app.get("/health")