Add HTMX-based UI templates and handlers for account and audit management

- Introduced `web/templates/` for HTMX-fragmented pages (`dashboard`, `accounts`, `account_detail`, `error_fragment`, etc.).
- Implemented UI routes for account CRUD, audit log display, and login/logout with CSRF protection.
- Added `internal/ui/` package for handlers, CSRF manager, session validation, and token issuance.
- Updated documentation to include new UI features and templates directory structure.
- Security: Double-submit CSRF cookies, constant-time HMAC validation, login password/Argon2id re-verification at all steps to prevent bypass.

internal/ui/context.go

@@ -0,0 +1,30 @@
+package ui
+
+import (
+	"context"
+
+	"git.wntrmute.dev/kyle/mcias/internal/token"
+)
+
+// uiContextKey is the unexported type for UI context values, preventing
+// collisions with keys from other packages.
+type uiContextKey int
+
+const (
+	uiClaimsKey uiContextKey = iota
+)
+
+// contextWithClaims stores validated JWT claims in the request context.
+func contextWithClaims(ctx context.Context, claims *token.Claims) context.Context {
+	return context.WithValue(ctx, uiClaimsKey, claims)
+}
+
+// claimsFromContext retrieves the JWT claims stored by requireCookieAuth.
+// Returns nil if no claims are present (unauthenticated request).
+func claimsFromContext(ctx context.Context) *token.Claims {
+	c, ok := ctx.Value(uiClaimsKey).(*token.Claims)
+	if !ok {
+		return nil
+	}
+	return c
+}