Syntax highlighting, rate limiting, creator auto-unlock (#1, #2, #26)

#1: server-side regex highlighter (highlight.go) for go/python/js/json/bash/sql;
token span classes styled in app.css; per-line so gutter stays aligned.
#2: in-memory token-bucket rate limiter (ratelimit.go) on POST /api/pastes,
/api/guess-language and unlock POST; 429 + Retry-After + X-RateLimit headers.
#26: new-page JS POSTs the password to /{id} with ?next= after creation; the
unlock handler honors same-origin ?next= redirect so the creator lands on the
unlocked paste. POST /{id} route added.

Tests: ratelimit_test.go (burst/429, refill, unlock limit, highlight, auto-
unlock e2e); existing tests updated for per-test limiter isolation.

web/templates/new.html

@@ -162,8 +162,18 @@ async function create() {
   showResult('<a href="' + url + '">' + url + '</a>', false);
   $('result').dataset.token = data.deletion_token || '';
   try { navigator.clipboard.writeText(url); toast('Copied'); } catch(e) {}
+  const dest = '/' + data.id + '?created=1&token=' + encodeURIComponent(data.deletion_token || '');
+  // password-protected: unlock now with the password we already have (#26)
+  if ($('haspw').checked && data.id) {
+    const fd = new FormData();
+    fd.append('password', $('password').value);
+    fd.append('next', dest);
+    try {
+      await fetch('/' + data.id, {method: 'POST', body: fd});
+    } catch(e) {}
+  }
   // show the paste
-  location.href = '/' + data.id + '?created=1&token=' + encodeURIComponent(data.deletion_token || '');
+  location.href = dest;
 }
 $('create').addEventListener('click', create);
 // reset stale result state when returning via Back (bfcache) (#28)