Cans UI + parity: unlock-cookie flow, /can page, listings badge, custom slug, delete, sweeper; #32 perf notes (#4, #32)

docs/API.md

@@ -80,18 +80,29 @@ curl -X POST http://localhost:8080/api/guess-language \
 
 ## Cans (bundles of items)
 
+A can bundles multiple text items (and files) into one shareable page at
+`/can/{id}`. Password, expiry, visibility, custom slug, and viewer-scoped
+deletion work exactly like pastes; cans appear as normal rows (with a `can`
+badge) in `/api/public` and `/api/mine`.
+
 ```bash
 curl -X POST http://localhost:8080/api/pastes/can \
   -F "title=My bundle" \
   -F "expires_in=48h" \
+  -F "custom_slug=my-bundle" \
   -F 'json_items=[{"title":"notes.txt","content":"some notes"}]' \
   -F "files=@screenshot.png" \
   -F "files=@log.txt"
 
 curl http://localhost:8080/api/cans/{id}
 curl http://localhost:8080/api/cans/{id}/items/{item_id}
+curl -X DELETE http://localhost:8080/api/cans/{id}   # creator browser only (vwr cookie)
 ```
 
+Password-protected cans use the same unlock flow as pastes: `POST /can/{id}`
+with the password sets an HMAC-bound cookie; item fetches accept the cookie as
+well as the `X-Paste-Password` header / `?password=` query param.
+
 ## Web pages
 
 - `/new` — create a paste