Add server, routes, views, CLI, CSS, and integration tests

- Server factory with Fastify plugins (JWT, cookie, multipart, formbody, static)
- Auth middleware: requireAuth preHandler (401 for API, redirect for pages)
- Auth API routes: POST /api/v1/auth/login, POST /api/v1/auth/logout
- File API routes: GET/POST /api/v1/files, DELETE /api/v1/files/:id
- Page routes: /, /login, /logout, /upload, /files, /files/:id/delete, /f/:id, /f/:id/raw
- HTML views: layout, login, upload, file-list, file-view, not-found
- CLI register-user script
- public/style.css dark theme
- Test helpers: createTestApp, loginAs, buildMultipart
- Integration tests for auth API, file API, and page routes (51 tests passing)
- Update CLAUDE.md with red/green TDD and commit instructions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/views/upload.ts

@@ -0,0 +1,36 @@
+import { layout, escHtml } from './layout.ts';
+
+export function uploadPage(opts: { error?: string } = {}): string {
+  const errorHtml = opts.error ? `<p class="error">${opts.error}</p>` : '';
+
+  return layout('Upload', `
+    <div class="form-container">
+      <h1>Upload a file</h1>
+      ${errorHtml}
+      <form method="POST" action="/upload" enctype="multipart/form-data">
+        <label>
+          File
+          <input type="file" name="file" required>
+        </label>
+        <button type="submit">Upload</button>
+      </form>
+    </div>
+  `, { authed: true });
+}
+
+export function uploadResultPage(shareUrl: string, filename: string): string {
+  const safeUrl = escHtml(shareUrl);
+  const safeName = escHtml(filename);
+
+  return layout('File uploaded', `
+    <div class="form-container">
+      <h1>File uploaded</h1>
+      <p><strong>${safeName}</strong> is ready to share.</p>
+      <div class="share-box">
+        <input type="text" id="share-url" value="${safeUrl}" readonly>
+        <button onclick="navigator.clipboard.writeText(document.getElementById('share-url').value)">Copy link</button>
+      </div>
+      <p><a href="/upload">Upload another</a> &middot; <a href="/files">My files</a></p>
+    </div>
+  `, { authed: true });
+}