My pastes page /mine with anonymous viewer cookie (#37)

- vwr cookie middleware: random browser id set on first visit (reused by #49)
- pastes table gains viewer_id column, set server-side at creation from the cookie
- GET /api/mine lists pastes for the requesting browser (title/lang/size/created)
- DELETE enforcement: 403 when client-sent vwr doesn't match the paste's viewer_id
- /mine page reuses history table styling, delete buttons, empty state
- nav: 'Saved' item between Public and Git; Git gets external-link arrow (#56)
- tests: create-with-cookie appears in /mine, other cookie doesn't, delete enforcement

Closes #37

web/templates/layout.html

@@ -17,7 +17,8 @@
     <nav>
       <a href="/new" {{if eq .Page "new"}}class="on"{{end}}>New</a>
       <a href="/history" {{if eq .Page "history"}}class="on"{{end}}>Public</a>
-      <a href="https://git.archfox.org/poslop/palette" target="_blank" rel="noopener">Git</a>
+      <a href="/mine" {{if eq .Page "mine"}}class="on"{{end}}>Saved</a>
+      <a href="https://git.archfox.org/poslop/palette" target="_blank" rel="noopener">Git<svg class="ext" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a>
     </nav>
     <div class="spacer"></div>
     <a class="iconbtn gear" href="/settings" title="Settings" aria-label="Settings">