Add password-visibility toggle to login page (TypeScript)

- web/ts/login.ts: small vanilla TS module toggling the password input's
  type between 'password'/'text' via a 'Show/Hide' button, so users can
  rule out typos before submitting. Compiled to web/static/login.js
  (ES module) via tsc (web/tsconfig.json, new 'make web-ts'/'web-assets'
  Makefile targets) and loaded via <script type="module">. Compiled JS
  is committed/embedded the same way as the compiled CSS — no Node.js
  needed at runtime.
- Verified end-to-end against the live proxied server
  (https://local.unqr.dev/web/login): POST /web/login correctly returns
  303 + Set-Cookie, and the session then authorizes GET /web/ — the
  server-side login flow is confirmed working correctly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -181,7 +181,8 @@ A small server-rendered dashboard is served at `/web/` (separate from the
 DAV endpoints, which stay on HTTP Basic Auth):
 
 - **Login** (`/web/login`) — cookie-based session, stored server-side in
-  `nidus.db` (`web_sessions` table), independent of DAV Basic Auth.
+  `nidus.db` (`web_sessions` table), independent of DAV Basic Auth. Includes
+  a "Show/Hide" password toggle to rule out typos before submitting.
 - **Dashboard** (`/web/`) — lists your own calendars/address books, who
   they're shared with, and any resources other users have shared with you.
 - **Share management** — add/remove shares directly from the dashboard
@@ -190,16 +191,18 @@ DAV endpoints, which stay on HTTP Basic Auth):
 - **Logout** (`/web/logout`).
 
 Implementation: [templ](https://templ.guide/) for type-safe Go HTML
-templates, [Tailwind CSS v4](https://tailwindcss.com/) for styling, and
-htmx for the sprinkles of dynamic behavior (form submission via
-POST/DELETE, partial page swaps) — no separate JS build/framework needed.
-The compiled CSS and the htmx bundle are embedded into the Go binary
+templates, [Tailwind CSS v4](https://tailwindcss.com/) for styling, htmx
+for the sprinkles of dynamic behavior (form submission via POST/DELETE,
+partial page swaps), and TypeScript (compiled to plain JS, `web/ts/`) for
+the few bits of client-side-only logic (e.g. the password-visibility
+toggle) — no separate JS framework needed. The compiled CSS, compiled JS,
+and the htmx bundle are all embedded into the Go binary
 (`web/staticassets.go`), so no Node.js is required at runtime, only when
-you change styles or templates during development:
+you change styles, templates, or TypeScript during development:
 
 ```bash
-make web-deps   # once, installs the Tailwind CLI (needs Node.js/npm)
-make web-css    # regenerate templ code + rebuild web/static/app.css
+make web-deps    # once, installs the Tailwind CLI + TypeScript compiler (needs Node.js/npm)
+make web-assets  # regenerate templ code + rebuild web/static/app.css and web/static/*.js
 ```
 
 ---