v0.1.4

Add protected layout, move pages, remove proxy

Introduce a new (protected)/layout.tsx that enforces auth by validating a stash_session cookie against an HMAC-SHA256 token derived from ADMIN_PASSWORD and redirects unauthenticated requests to /login. Move several route pages into the (protected) group (/, [bucket], events, keys) so they are guarded by the new layout. Remove the previous proxy middleware (web/src/proxy.ts) which performed similar session checks. Also: remove Navbar from the global root layout and render it in the protected layout instead, and tweak the login page min-height to use full screen (min-h-screen).