Remove cans feature; add Secure flag to pw_/tok_ cookies

Owner decision 2026-10-16: the cans feature (bundles of pastes, #4) was
half-integrated and has zero prod usage; removing it eliminates four audit
findings by deletion.

Removed:
- internal/api/cans.go and all can routes (/api/pastes/can, /api/cans/*,
  /can/{id}) plus handleCanPage/renderCan
- is_can from /api/mine and /api/public responses
- store layer: CanRow, can store funcs, paste_cans UNION in listings,
  cans sweep; reserved slugs 'can'/'cans' released
- templates/can.html, can CSS, is_can badges in history.js/mine.js
- cans tests (cans_test.go, cans_flow_test.go, cans_expiry_test.go,
  TestErrorCodeCanValidation)
- docs/api.md cans section, README/LICENSE/docker-compose mentions

Store migration: drops paste_cans only when empty (non-empty table is
kept and logged; prod verified clean 2026-10-16) and drops the dormant
pastes.can_id column. Covered by new TestMigrateDropsCansSchema.

Security hardening (audit findings): pw_<id> (unlock) and tok_<id>
(deletion-token) cookies now carry Secure: true in addition to
HttpOnly + SameSite=Lax; all deployments are HTTPS-only. cookie_set_test
now asserts Secure.

go vet ./... and go test ./... pass.

internal/web/templates/can.html

@@ -1,36 +0,0 @@
-{{template "head" .}}
-{{template "topbar" .}}
-<div class="center">
-  <div class="float can-page">
-    <div class="inner">
-      <h1>{{.Title}} <span class="badge" title="This is a can — a bundle of pastes">can</span></h1>
-      {{if .HasDescription}}<p class="sub">{{.Description}}</p>{{end}}
-      <p class="hint">{{.ItemCount}} item{{if ne .ItemCount 1}}s{{end}} · {{.SizeHuman}} · created <span data-ts="{{.CreatedAtUnix}}">{{.CreatedAgo}}</span>{{if .ExpiresAt}} · expires in {{.ExpiresIn}}{{end}}{{if .HasPassword}} · password protected{{end}}</p>
-
-      <div class="can-items">
-        {{range .Items}}
-        <div class="can-item float">
-          <div class="can-item-head">
-            <strong>{{.Title}}</strong>
-            <span class="dim">{{.Size}}</span>
-            {{if .IsFile}}
-              <a class="btn btn-icon" href="/api/cans/{{$.ID}}/items/{{.ID}}" download="{{.Title}}" title="Download file" aria-label="Download {{.Title}}">↓</a>
-            {{else}}
-              <a class="btn btn-icon" href="/api/cans/{{$.ID}}/items/{{.ID}}" title="Raw item" aria-label="Raw {{.Title}}">⧉</a>
-            {{end}}
-          </div>
-          {{if not .IsFile}}
-          <details class="can-item-body">
-            <summary>Show content</summary>
-            <pre class="code"><code>{{.ContentHTML}}</code></pre>
-          </details>
-          {{else}}
-          <div class="hint">Attached file — use the download button above.</div>
-          {{end}}
-        </div>
-        {{end}}
-      </div>
-    </div>
-  </div>
-</div>
-{{template "foot" .}}