feat: wire auth into the web layer (Schritt 2, part 2/2)

Registration creates a new account plus its first user; login
authenticates an existing one; both set a deklarix_session cookie
(HttpOnly, SameSite=Strict, Secure only when the request itself came
over TLS — hardcoding Secure=true would break local http://localhost
development, since browsers won't store a Secure cookie over plaintext).

requirePage protects full-page GETs (redirects to /login); requireAPI
protects the htmx/download endpoints (401, since those are only ever
called from an already-authenticated page — an unauthenticated hit
there is the exception, e.g. a session expiring mid-use).

handleCheck now creates submissions under the current account.
handleArchive and handleDossierDownload compare the submission's
account against the caller's and return 404 on mismatch — not 403,
which would confirm the ID exists to a different tenant. Login failure
uses the same message for "no such email" and "wrong password" to avoid
account enumeration.

Restructured templates along the way: layout.html now only holds
reusable fragments ("head", "nav"); each full page (index/login/register)
is its own top-level named template. The previous layout+content nesting
would have broken the moment a second page defined "content" — Go's
html/template keys blocks by name across the whole parsed set, not per
file, so two pages both defining "content" would silently overwrite each
other.

Verified against a real running instance (not just Go's test recorder):
started the compiled binary against a fresh Postgres and drove the whole
flow with curl — anonymous redirect, registration setting a real cookie,
authenticated page load, logout clearing both the cookie and the
server-side session row, and being locked out again afterward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/web/auth_handlers.go

@@ -0,0 +1,136 @@
+package web
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/netcell-it/deklarix/internal/auth"
+)
+
+type authPageData struct {
+	Title string
+	Error string
+}
+
+func (s *Server) renderAuthPage(w http.ResponseWriter, name string, data authPageData) {
+	if err := s.templates.ExecuteTemplate(w, name, data); err != nil {
+		http.Error(w, "Seite konnte nicht gerendert werden", http.StatusInternalServerError)
+	}
+}
+
+func (s *Server) handleRegisterForm(w http.ResponseWriter, r *http.Request) {
+	s.renderAuthPage(w, "register", authPageData{Title: "Registrieren"})
+}
+
+func (s *Server) handleLoginForm(w http.ResponseWriter, r *http.Request) {
+	s.renderAuthPage(w, "login", authPageData{Title: "Anmelden"})
+}
+
+// handleRegister legt einen neuen Mandanten (Account) und den ersten
+// Nutzer darin an. Es gibt bewusst keinen separaten "Account beitreten"-
+// Flow — das wäre Schritt 4 (Agentur-/Markensicht mit mehreren Nutzern
+// pro Account), hier reicht ein Nutzer pro neuem Account.
+func (s *Server) handleRegister(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.renderAuthPage(w, "register", authPageData{Title: "Registrieren", Error: "ungültiges Formular"})
+		return
+	}
+
+	accountName := r.FormValue("account_name")
+	email := r.FormValue("email")
+	password := r.FormValue("password")
+	role := r.FormValue("role")
+	if accountName == "" || email == "" || password == "" || role == "" {
+		s.renderAuthPage(w, "register", authPageData{Title: "Registrieren", Error: "Alle Felder sind Pflicht"})
+		return
+	}
+
+	passwordHash, err := auth.HashPassword(password)
+	if err != nil {
+		s.renderAuthPage(w, "register", authPageData{Title: "Registrieren", Error: err.Error()})
+		return
+	}
+
+	ctx := r.Context()
+	acc, err := s.store.CreateAccount(ctx, accountName)
+	if err != nil {
+		s.renderAuthPage(w, "register", authPageData{Title: "Registrieren", Error: "Konto konnte nicht angelegt werden"})
+		return
+	}
+	user, err := s.store.CreateUser(ctx, acc.ID, email, passwordHash, role)
+	if err != nil {
+		s.renderAuthPage(w, "register", authPageData{Title: "Registrieren", Error: "Nutzer konnte nicht angelegt werden — E-Mail evtl. schon vergeben"})
+		return
+	}
+
+	if err := s.startSession(w, r, user.ID); err != nil {
+		s.renderAuthPage(w, "register", authPageData{Title: "Registrieren", Error: "Sitzung konnte nicht gestartet werden"})
+		return
+	}
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}
+
+func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.renderAuthPage(w, "login", authPageData{Title: "Anmelden", Error: "ungültiges Formular"})
+		return
+	}
+
+	email := r.FormValue("email")
+	password := r.FormValue("password")
+
+	ctx := r.Context()
+	user, err := s.store.GetUserByEmail(ctx, email)
+	if err != nil {
+		// Absichtlich dieselbe Meldung wie bei falschem Passwort — sonst
+		// verrät die Fehlermeldung, ob eine E-Mail-Adresse existiert.
+		s.renderAuthPage(w, "login", authPageData{Title: "Anmelden", Error: "E-Mail oder Passwort falsch"})
+		return
+	}
+	if err := auth.VerifyPassword(user.PasswordHash, password); err != nil {
+		s.renderAuthPage(w, "login", authPageData{Title: "Anmelden", Error: "E-Mail oder Passwort falsch"})
+		return
+	}
+
+	if err := s.startSession(w, r, user.ID); err != nil {
+		s.renderAuthPage(w, "login", authPageData{Title: "Anmelden", Error: "Sitzung konnte nicht gestartet werden"})
+		return
+	}
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}
+
+func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
+	if cookie, err := r.Cookie(sessionCookieName); err == nil {
+		_ = s.store.DeleteSession(r.Context(), cookie.Value)
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name: sessionCookieName, Value: "", Path: "/", MaxAge: -1,
+	})
+	http.Redirect(w, r, "/login", http.StatusSeeOther)
+}
+
+// startSession erzeugt eine neue Sitzung und setzt das Session-Cookie.
+// Secure ist an genau dann, wenn die Anfrage selbst über TLS kam — ein
+// fest verdrahtetes Secure=true würde lokale Entwicklung ohne TLS
+// (http://localhost) brechen, da Browser ein Secure-Cookie über Klartext-
+// HTTP schlicht nicht speichern.
+func (s *Server) startSession(w http.ResponseWriter, r *http.Request, userID string) error {
+	token, err := auth.NewSessionToken()
+	if err != nil {
+		return err
+	}
+	expiresAt := time.Now().Add(auth.SessionDuration)
+	if _, err := s.store.CreateSession(r.Context(), token, userID, expiresAt); err != nil {
+		return err
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    token,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   r.TLS != nil,
+		SameSite: http.SameSiteStrictMode,
+		Expires:  expiresAt,
+	})
+	return nil
+}