Syntax highlighting, rate limiting, creator auto-unlock (#1, #2, #26)

#1: server-side regex highlighter (highlight.go) for go/python/js/json/bash/sql;
token span classes styled in app.css; per-line so gutter stays aligned.
#2: in-memory token-bucket rate limiter (ratelimit.go) on POST /api/pastes,
/api/guess-language and unlock POST; 429 + Retry-After + X-RateLimit headers.
#26: new-page JS POSTs the password to /{id} with ?next= after creation; the
unlock handler honors same-origin ?next= redirect so the creator lands on the
unlocked paste. POST /{id} route added.

Tests: ratelimit_test.go (burst/429, refill, unlock limit, highlight, auto-
unlock e2e); existing tests updated for per-test limiter isolation.

main_test.go

@@ -11,6 +11,7 @@ import (
 
 func testServer(t *testing.T) *apiServer {
 	t.Helper()
+	globalLimiter = newLimiter() // fresh buckets per test
 	store, err := OpenStore(":memory:")
 	if err != nil {
 		t.Fatal(err)