Remove cans feature; add Secure flag to pw_/tok_ cookies

Owner decision 2026-10-16: the cans feature (bundles of pastes, #4) was
half-integrated and has zero prod usage; removing it eliminates four audit
findings by deletion.

Removed:
- internal/api/cans.go and all can routes (/api/pastes/can, /api/cans/*,
  /can/{id}) plus handleCanPage/renderCan
- is_can from /api/mine and /api/public responses
- store layer: CanRow, can store funcs, paste_cans UNION in listings,
  cans sweep; reserved slugs 'can'/'cans' released
- templates/can.html, can CSS, is_can badges in history.js/mine.js
- cans tests (cans_test.go, cans_flow_test.go, cans_expiry_test.go,
  TestErrorCodeCanValidation)
- docs/api.md cans section, README/LICENSE/docker-compose mentions

Store migration: drops paste_cans only when empty (non-empty table is
kept and logged; prod verified clean 2026-10-16) and drops the dormant
pastes.can_id column. Covered by new TestMigrateDropsCansSchema.

Security hardening (audit findings): pw_<id> (unlock) and tok_<id>
(deletion-token) cookies now carry Secure: true in addition to
HttpOnly + SameSite=Lax; all deployments are HTTPS-only. cookie_set_test
now asserts Secure.

go vet ./... and go test ./... pass.

internal/api/issue105_errorcode_test.go

@@ -86,38 +86,3 @@ func TestErrorCodeRateLimited(t *testing.T) {
 	}
 	t.Fatalf("never got rate_limited, last code = %q", code)
 }
-
-func TestErrorCodeCanValidation(t *testing.T) {
-	h := testServer(t).routes()
-
-	post := func(fields map[string]string) *httptest.ResponseRecorder {
-		var b strings.Builder
-		for k, v := range fields {
-			b.WriteString("--B\r\nContent-Disposition: form-data; name=\"" + k + "\"\r\n\r\n" + v + "\r\n")
-		}
-		b.WriteString("--B--\r\n")
-		req := httptest.NewRequest("POST", "/api/pastes/can", strings.NewReader(b.String()))
-		req.Header.Set("Content-Type", "multipart/form-data; boundary=B")
-		rec := httptest.NewRecorder()
-		h.ServeHTTP(rec, req)
-		return rec
-	}
-
-	// bad visibility
-	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "visibility": "nope"})); code != "invalid_visibility" {
-		t.Fatalf("visibility code = %q, want invalid_visibility", code)
-	}
-
-	// invalid expiry
-	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "expires_in": "1s"})); code != "expiry_invalid" {
-		t.Fatalf("expiry code = %q, want expiry_invalid", code)
-	}
-
-	// slug taken on can create
-	if rec := postCreate(h, `{"content":"a","custom_slug":"can-slug"}`); rec.Code != 201 {
-		t.Fatalf("seed create: %d", rec.Code)
-	}
-	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "custom_slug": "can-slug", "json_items": `[{"title":"a","content":"b"}]`})); code != "slug_taken" {
-		t.Fatalf("can slug code = %q, want slug_taken", code)
-	}
-}