fix: convert auth flows from SSE to standard HTTP to fix session cookies

Datastar's NewSSE() flushes HTTP headers before SCS's session middleware
can attach the Set-Cookie header, so the session cookie never reaches the
browser after login/register/logout.

Convert login, register, and logout to standard HTML forms with HTTP
redirects, which lets SCS write cookies normally. Also fix return_url
capture on the login page (was never being stored in the session).

Add handler tests covering login, register, and logout flows.

features/lobby/handlers.go

@@ -171,7 +171,6 @@ func HandleLogout(sessions *scs.SessionManager) http.HandlerFunc {
 			return
 		}
 
-		sse := datastar.NewSSE(w, r)
-		sse.ExecuteScript("window.location.href='/'") //nolint:errcheck
+		http.Redirect(w, r, "/", http.StatusSeeOther)
 	}
 }

features/lobby/pages/lobby.templ

@@ -20,13 +20,11 @@ templ LobbyPage(data LobbyData) {
 			if data.IsLoggedIn {
 				<div class="flex justify-center items-center gap-4 mb-4 p-2 bg-base-200 rounded-lg">
 					<span>Logged in as <strong>{ data.Username }</strong></span>
-					<button
-						type="button"
-						class="btn btn-ghost btn-sm"
-						data-on:click={ datastar.PostSSE("/logout") }
-					>
-						Logout
-					</button>
+					<form method="POST" action="/logout" class="inline">
+						<button type="submit" class="btn btn-ghost btn-sm">
+							Logout
+						</button>
+					</form>
 				</div>
 			} else {
 				<div class="alert text-sm mb-4">