db: integrate golang-migrate for schema migrations

- internal/db/migrations/: five embedded SQL files containing
  the migration SQL previously held as Go string literals.
  Files follow the NNN_description.up.sql naming convention
  required by golang-migrate's iofs source.
- internal/db/migrate.go: rewritten to use
  github.com/golang-migrate/migrate/v4 with the
  database/sqlite driver (modernc.org/sqlite, pure Go) and
  source/iofs for compile-time embedded SQL.
  - newMigrate() opens a dedicated *sql.DB so m.Close() does
    not affect the caller's shared connection.
  - Migrate() includes a compatibility shim: reads the legacy
    schema_version table and calls m.Force(v) before m.Up()
    so existing databases are not re-migrated.
  - LatestSchemaVersion promoted from var to const.
- internal/db/db.go: added path field to DB struct; Open()
  translates ':memory:' to a named shared-cache URI
  (file:mcias_N?mode=memory&cache=shared) so the migration
  runner can open a second connection to the same in-memory
  database without sharing the handle that golang-migrate
  will close on teardown.
- go.mod: added golang-migrate/migrate/v4 v4.19.1 (direct).
All callers unchanged. All tests pass; golangci-lint clean.

web/static/style.css

@@ -9,6 +9,17 @@ nav { background: #1a1a2e; color: #fff; padding: 0.5rem 1rem; }
 .nav-links a { color: #ccc; text-decoration: none; }
 .nav-links a:hover { color: #fff; }
 .nav-actor { color: #aaa; font-size: 0.85rem; }
+/* Login page layout */
+.login-wrapper { display: flex; align-items: center; justify-content: center; min-height: 100vh; padding: 2rem; }
+.login-box { width: 100%; max-width: 380px; }
+.brand-heading { font-size: 2rem; font-weight: 700; text-align: center; letter-spacing: 0.05em; color: #1a1a2e; margin-bottom: 0.25rem; }
+.brand-subtitle { font-size: 0.8rem; text-align: center; color: #666; margin-bottom: 1.5rem; letter-spacing: 0.02em; }
+.login-box .card { background: #fff; border: 1px solid #dee2e6; border-radius: 6px; padding: 1.75rem 2rem; box-shadow: 0 2px 8px rgba(0,0,0,0.07); }
+.form-group { margin-bottom: 1rem; }
+.form-group label { display: block; margin-bottom: 0.35rem; font-size: 0.9rem; font-weight: 500; }
+.form-control { width: 100%; padding: 0.5rem 0.6rem; border: 1px solid #ced4da; border-radius: 4px; font-size: 0.95rem; }
+.form-control:focus { outline: none; border-color: #0d6efd; box-shadow: 0 0 0 2px rgba(13,110,253,0.2); }
+.form-actions { margin-top: 1.25rem; }
 .btn { display: inline-block; padding: 0.4rem 0.8rem; border: none; border-radius: 4px; cursor: pointer; font-size: 0.9rem; }
 .btn-sm { padding: 0.2rem 0.5rem; font-size: 0.8rem; }
 .btn-primary { background: #0d6efd; color: #fff; }

web/templates/login.html

@@ -10,6 +10,7 @@
 <div class="login-wrapper">
   <div class="login-box">
     <div class="brand-heading">MCIAS</div>
+    <div class="brand-subtitle">Metacircular Identity &amp; Access System</div>
     <div class="card">
       {{if .Error}}<div class="alert alert-error" role="alert">{{.Error}}</div>{{end}}
       <form id="login-form" method="POST" action="/login"