fix: convert auth flows from SSE to standard HTTP to fix session cookies

Datastar's NewSSE() flushes HTTP headers before SCS's session middleware
can attach the Set-Cookie header, so the session cookie never reaches the
browser after login/register/logout.

Convert login, register, and logout to standard HTML forms with HTTP
redirects, which lets SCS write cookies normally. Also fix return_url
capture on the login page (was never being stored in the session).

Add handler tests covering login, register, and logout flows.

features/lobby/handlers.go

@@ -171,7 +171,6 @@ func HandleLogout(sessions *scs.SessionManager) http.HandlerFunc {
 			return
 		}
 
-		sse := datastar.NewSSE(w, r)
-		sse.ExecuteScript("window.location.href='/'") //nolint:errcheck
+		http.Redirect(w, r, "/", http.StatusSeeOther)
 	}
 }