Project deletion in the panel; project page works without a session ...

- DELETE /api/projects/{id} existed but had no UI: danger icon button on
  each project card + GnConfirmDialog (cascade handled by the DB FK).
- /p/<token> errored for logged-out visitors: the report list hit the
  owner-only /projects/{id}/reports. Added a public
  /projects/by-token/{token}/reports endpoint (same shape) and pointed
  ProjectPage at it.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Server: FastAPI backend with auth, projects, reports, uploads ...

- FastAPI + SQLAlchemy async + Alembic, PostgreSQL in docker-compose
- Auth: argon2id, cookie sessions (web) + bearer tokens (extension)
- Unguessable share tokens (128-bit) on projects and reports
- Content-addressed file storage with mime sniffing, token-scoped download
- Reports with nested steps; server-side password masking

Co-Authored-By: Claude Code <noreply@anthropic.com>