Remove cans feature; add Secure flag to pw_/tok_ cookies

Owner decision 2026-10-16: the cans feature (bundles of pastes, #4) was
half-integrated and has zero prod usage; removing it eliminates four audit
findings by deletion.

Removed:
- internal/api/cans.go and all can routes (/api/pastes/can, /api/cans/*,
  /can/{id}) plus handleCanPage/renderCan
- is_can from /api/mine and /api/public responses
- store layer: CanRow, can store funcs, paste_cans UNION in listings,
  cans sweep; reserved slugs 'can'/'cans' released
- templates/can.html, can CSS, is_can badges in history.js/mine.js
- cans tests (cans_test.go, cans_flow_test.go, cans_expiry_test.go,
  TestErrorCodeCanValidation)
- docs/api.md cans section, README/LICENSE/docker-compose mentions

Store migration: drops paste_cans only when empty (non-empty table is
kept and logged; prod verified clean 2026-10-16) and drops the dormant
pastes.can_id column. Covered by new TestMigrateDropsCansSchema.

Security hardening (audit findings): pw_<id> (unlock) and tok_<id>
(deletion-token) cookies now carry Secure: true in addition to
HttpOnly + SameSite=Lax; all deployments are HTTPS-only. cookie_set_test
now asserts Secure.

go vet ./... and go test ./... pass.

internal/web/static/app.css

@@ -694,26 +694,6 @@ a.admin-link:hover { color: var(--fg); text-decoration: underline; }
   .center .foot { font-size: 13px; }
 }
 
-/* #4: can view page + can builder */
-.can-page h1 { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
-.can-items { display: flex; flex-direction: column; gap: 12px; margin-top: 14px; }
-.can-item { padding: 12px 14px; }
-.can-item-head { display: flex; align-items: center; gap: 10px; }
-.can-item-head strong { flex: 1; word-break: break-all; }
-.can-item-body { margin-top: 8px; }
-.can-item-body summary { cursor: pointer; font-size: 19px; color: var(--muted, #888); }
-/* #169: divider between the dropdown title and body must be persistent
-   (not hover dependent) and extend the full width of the card left and right */
-.can-item-body[open] summary {
-  border-bottom: 1px solid var(--border);
-  margin: 0 -14px 8px;
-  padding: 0 14px 8px;
-}
-.can-item-body pre.code { margin: 8px 0 0; overflow-x: auto; }
-.can-item-row { margin-top: 8px; }
-.can-item-row .can-item-title { width: 100%; margin-bottom: 6px; }
-.can-item-row .can-item-content { width: 100%; font-family: var(--mono, monospace); resize: vertical; }
-
 /* ============================================================
    Styled controls (#123) — buttons, selects, checkboxes, radios
    match the custom URL box house pattern: 1px var(--border) on
@@ -892,7 +872,6 @@ button[type="submit"]:focus-visible,
 
 /* #139: CSP-safe replacements for inline style attributes (style-src 'self') */
 .hidden { display: none; }
-.can-page { max-width: 900px; width: 100%; }
 .col-a { width: 260px; } .col-b { width: 140px; } .col-c { width: 120px; }
 .col-d { width: 90px; } .col-d2 { width: 150px; } .col-e { width: 150px; }
 .col-f { width: 100px; } .col-g { width: 120px; }

internal/web/static/history.js

@@ -6,8 +6,8 @@ const t = PaletteTable.init({
   rowHtml: it =>
     `<tr class="row" data-href="/${t.esc(it.id)}"><td>` +
     (it.title
-      ? `<a class="paste-name" href="/${t.esc(it.id)}">${t.esc(it.title)}</a>${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`
-      : `<a class="slug paste-name" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`) +
+      ? `<a class="paste-name" href="/${t.esc(it.id)}">${t.esc(it.title)}</a>`
+      : `<a class="slug paste-name" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>`) +
     `</td>` +
     `<td><span class="badge">${t.esc(it.type || it.language || 'text')}</span></td>` +
     `<td class="dim">${t.fmtSize(it.size)}</td><td class="dim">${it.view_count}</td><td class="dim" data-ts="${it.created_at}">${t.ago(it.created_at)}</td>` +

internal/web/static/mine.js

@@ -18,8 +18,8 @@ const t = PaletteTable.init({
   rowHtml: it =>
     `<tr class="row" data-href="/${t.esc(it.id)}"><td>` +
     (it.title
-      ? `<a class="paste-name" href="/${t.esc(it.id)}">${t.esc(it.title)}</a>${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`
-      : `<a class="slug paste-name" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>${it.is_can ? ' <span class="badge" title="Can — bundle of items">can</span>' : ''}`) +
+      ? `<a class="paste-name" href="/${t.esc(it.id)}">${t.esc(it.title)}</a>`
+      : `<a class="slug paste-name" href="/${t.esc(it.id)}">${t.esc(it.id)}</a>`) +
     `</td>` +
     `<td><span class="badge">${t.esc(it.type || it.language || 'text')}</span></td>` +
     `<td class="dim">${t.fmtSize(it.size)}</td><td class="dim" data-ts="${it.created_at}">${t.ago(it.created_at)}</td>` +