Add settings page with synced appearance and password change

- Store app settings as one JSON document on the server, merged per key and
  pushed to other devices; cache locally to avoid a flash on load
- Settings page groups appearance, account, shortcuts, shares, API tokens and
  trash; full screen with a section list on phones
- Font size and content width settings
- Change the login password, signing out other sessions
- Settings writes and password changes only accept a login session

internal/api/shares.go

@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"log/slog"
-	"net"
 	"net/http"
 	"path"
 	"strings"
@@ -191,11 +190,7 @@ func (s *Server) unlockShare(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if sh.PasswordHash != "" {
-		host, _, err := net.SplitHostPort(r.RemoteAddr)
-		if err != nil {
-			host = r.RemoteAddr
-		}
-		switch err := s.auth.CheckSharePassword(host, sh.PasswordHash, body.Password); {
+		switch err := s.auth.CheckSharePassword(clientIP(r), sh.PasswordHash, body.Password); {
 		case errors.Is(err, auth.ErrRateLimited):
 			writeError(w, 429, err.Error())
 			return