feat(web): reusable flash/notification banner (PRG)

Add a one-shot flash component used across the app — connect success,
disconnect, account delete, and registration — instead of per-page ad-hoc
markup. setFlash queues a short-lived HttpOnly+SameSite cookie carrying an
opaque code; takeFlash consumes it on the next full-page render (not on
HTMX fragments). flashBanner maps the code to a styled, role=status banner;
the message text lives server-side in flashMessages so the cookie never
carries free text and a forged/unknown code renders nothing.

Wire it into the list page (the PRG landing spot for connect/registration)
and set it on registration and connect-callback success. Styled with the
existing design-system tokens; header gains an Account nav link.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/handlers.go

@@ -109,7 +109,7 @@ func (a *App) handleList(w http.ResponseWriter, r *http.Request) {
 		a.render(w, r, summaryList(rows))
 		return
 	}
-	a.render(w, r, ListPage(rows, f))
+	a.render(w, r, ListPage(rows, f, takeFlash(w, r)))
 }
 
 // handleDetail renders one summary in full (highlights, takeaways, action group).