My pastes page /mine with anonymous viewer cookie (#37)

- vwr cookie middleware: random browser id set on first visit (reused by #49)
- pastes table gains viewer_id column, set server-side at creation from the cookie
- GET /api/mine lists pastes for the requesting browser (title/lang/size/created)
- DELETE enforcement: 403 when client-sent vwr doesn't match the paste's viewer_id
- /mine page reuses history table styling, delete buttons, empty state
- nav: 'Saved' item between Public and Git; Git gets external-link arrow (#56)
- tests: create-with-cookie appears in /mine, other cookie doesn't, delete enforcement

Closes #37

web.go

@@ -70,6 +70,10 @@ func (a *apiServer) handleSettingsPage(w http.ResponseWriter, r *http.Request) {
 	renderPage(w, "settings.html", map[string]any{"Page": "settings"})
 }
 
+func (a *apiServer) handleMinePage(w http.ResponseWriter, r *http.Request) {
+	renderPage(w, "mine.html", map[string]any{"Page": "mine"})
+}
+
 func agoString(ts int64) string {
 	s := time.Now().Unix() - ts
 	switch {