feat: implement skins/capes, profile endpoints, session server

Skins & capes:
- Fix uploadSkin auth: Bearer token instead of user_id form hack
- Add POST /api/web/profile/cape (upload cape)
- Add DELETE /api/web/profile/skin and DELETE /api/web/profile/cape
- Validate skin PNG dimensions (64x32, 64x64, 128x128, 128x64)
- Add size limits: 1 MB for skins, 2 MB for capes
- Add basic email validation on register

Profile & session server:
- Add GET /api/web/profile/{uuid} — public profile with skin/cape hashes
- Add GET /sessionserver/session/minecraft/profile/{uuid} — Mojang-compatible
  texture response for game client
- Add POST /authserver/invalidate and POST /authserver/signout
- Export VerifyPassword and ExtractBearer from auth package
- Remove duplicate verifyPassword from api.go
- Add PlayerTextures model to database.go

internal/database/database.go

@@ -74,14 +74,22 @@ type GlobalFile struct {
 	FileName string `db:"file_name"`
 }
 
+// PlayerTextures holds skin/cape references for a user.
+type PlayerTextures struct {
+	UserID   int    `db:"user_id"`
+	SkinHash string `db:"skin_hash"`
+	CapeHash string `db:"cape_hash"`
+	IsSlim   bool   `db:"is_slim"`
+}
+
 // LauncherRelease tracks published launcher binaries.
 type LauncherRelease struct {
-	ID         int    `db:"id"`
-	Version    string `db:"version"`
-	OS         string `db:"os"`
-	Arch       string `db:"arch"`
-	SHA256     string `db:"sha256"`
-	FilePath   string `db:"file_path"`
-	IsActive   bool   `db:"is_active"`
-	IsMandatory bool  `db:"is_mandatory"`
+	ID          int    `db:"id"`
+	Version     string `db:"version"`
+	OS          string `db:"os"`
+	Arch        string `db:"arch"`
+	SHA256      string `db:"sha256"`
+	FilePath    string `db:"file_path"`
+	IsActive    bool   `db:"is_active"`
+	IsMandatory bool   `db:"is_mandatory"`
 }