Add portal mode: DB-backed, login, topbar redesign and more

[dankor]

…(0.4.0)

Portal mode (opt-in via FIREFLYER_PORTAL) stores many dashboards in a database and lists them in a gallery, reusing the existing stateless editor unchanged. Scoped to web/ as an owner-approved exception to the no-persistence anti-goal.

• Store (web/portal.py): SqliteStore (dev/tests) + PostgresStore (runtime, lazy psycopg behind the .[portal] extra). Dashboards are opaque YAML blobs validated on save; name + author are columns. Gallery is a table (name, author, last updated) with Edit / Clone / Remove and a New-dashboard modal.
• Entrypoint: python -m fireflyer.portal (reads portal.yaml, binds 0.0.0.0); docker compose --profile portal brings up Postgres + the app.
• Auth (web/auth.py): login gate, default admin/admin, HMAC-signed session cookie, built on two swappable seams (Authenticator + session) so SSO/LDAP drop in without touching routes. Extension recipe documented in architecture.md.
• Dashboard YAML gains a required top-level name: key (local and portal).
• Editor topbar reworked: hamburger Dashboards link + logo + editable title (two-way with the name: key), Save (shown only when unsaved; Cmd/Ctrl+S), Preview, an icon theme switch (A / sun / moon) in the profile menu, profile dropdown. The Run button and status text are gone: editing greys the (still interactive) preview and shows a centered Refresh overlay.
• Fixes: row-height drags now persist for block-style rows; column resize now works on tabbed dashboards (previously searched flat .items only and no-op'd).

New tests: test_portal, test_auth, test_editor_page (no live DB or browser). Bumps version to 0.4.0.