Add password-visibility toggle to login page (TypeScript)

- web/ts/login.ts: small vanilla TS module toggling the password input's
  type between 'password'/'text' via a 'Show/Hide' button, so users can
  rule out typos before submitting. Compiled to web/static/login.js
  (ES module) via tsc (web/tsconfig.json, new 'make web-ts'/'web-assets'
  Makefile targets) and loaded via <script type="module">. Compiled JS
  is committed/embedded the same way as the compiled CSS — no Node.js
  needed at runtime.
- Verified end-to-end against the live proxied server
  (https://local.unqr.dev/web/login): POST /web/login correctly returns
  303 + Set-Cookie, and the session then authorizes GET /web/ — the
  server-side login flow is confirmed working correctly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/copilot-instructions.md

@@ -17,6 +17,8 @@ make tidy            # go mod tidy
 go test ./internal/store/ -run TestStoreRoundTrip -v   # single test
 make templ-generate  # regenerate *_templ.go after editing internal/web/templates/*.templ
 make web-css         # templ-generate + rebuild web/static/app.css (needs `make web-deps` once, Node.js/npm)
+make web-ts          # compile web/ts/*.ts to web/static/*.js
+make web-assets      # web-css + web-ts (everything under web/static/)
 ```
 
 Test files: `internal/store/store_test.go`, `internal/webdav/handler_test.go`,
@@ -154,10 +156,15 @@ Test files: `internal/store/store_test.go`, `internal/webdav/handler_test.go`,
   to `web/static/app.css` via `make web-css` (needs Node/npm — see
   `web/package.json`); htmx itself is vendored as a static file
   (`web/static/htmx.min.js`, not npm-installed) to avoid a CDN dependency.
-  Both static assets are embedded into the Go binary at build time via
+  Client-side-only logic (currently just the login page's password-visibility
+  toggle) is written in TypeScript under `web/ts/*.ts`, compiled to plain
+  JS via `tsc` (`web/tsconfig.json`, `make web-ts`) into `web/static/*.js`
+  as ES modules (`<script type="module">`). All static assets (CSS, JS,
+  vendored htmx) are embedded into the Go binary at build time via
   `web/staticassets.go` (`//go:embed static`), so the compiled server has
   no runtime dependency on Node.js or the `web/` directory being present —
-  Node/npm are only needed when actually changing templates/styles.
+  Node/npm are only needed when actually changing templates/styles/TS
+  (`make web-assets` rebuilds everything under `web/static/`).
 
 ## Conventions