[duaneatat]

Chat is on-for-everyone or off today, so we can't let testers use it on a reachable server without also opening it (and the OpenRouter bill) to anyone. Until there are accounts, this adds an optional shared access code. Testers go to `/chat`, enter the code, and get a signed HttpOnly cookie that the chat routes require. The "Ask" link stays hidden until then. Chat history is still only in the browser's localStorage, so nothing new is stored on the server.

It's a stopgap: anyone given the code can pass it on, and the only way to revoke access is to change the code, which signs everyone out. The check is one FastAPI dependency, so a magic-link login can replace it later.

• `CHAT_ACCESS_CODE` turns the gate on (unset keeps today's behavior for local dev); `CHAT_ACCESS_DAYS` sets how long a browser stays signed in (default 30).
• `POST /api/chat/unlock` checks the code, 10 tries per IP per hour; `POST /api/chat` and `/api/chat/data` answer 401 without the cookie, and `/api/chat/status` gains `unlocked`.
• nginx now passes `X-Forwarded-Proto` to the chat routes so the cookie is `Secure` over https; the justfile passes the new variables to the API container.
• Tested locally with the demo model: wrong code, right code, cookie surviving a reload, and changing the code bringing the form back.

[iansargent]

I like this feature, of course until we create proper profiles!