Let public visitors request a reader account

New public page GET/POST /request-access explains what a signed-in
reader account gets (complete issues online, EPUB/XTC downloads, no
ratings or admin tools) and takes an email plus an optional reason. A
honeypot field drops bots and a partial unique index keeps one open
request per email, updating it on resubmit. Open requests show on
/dashboard/users with a "Mark done" button and as a tile on the
overview; accounts are still created with the daily-epub users CLI.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QVPagF6jfDv78CC5Jv2wp4

src/web/templates/dashboard/overview.html

@@ -10,6 +10,7 @@
 <div class="tile"><span class="tile-label">Verdicts, 7 days</span><span class="tile-num">{{ ratings_total }}</span><span class="tile-delta"><a href="/dashboard/ratings">rating history</a></span></div>
 <div class="tile"><span class="tile-label">Unrated picks</span><span class="tile-num">{{ unrated.len() }}</span><span class="tile-delta">from the last three issues</span></div>
 <div class="tile"><span class="tile-label">Active jobs</span><span class="tile-num">{{ active_jobs.len() }}</span><span class="tile-delta"><a href="/dashboard/jobs">all jobs</a></span></div>
+<div class="tile"><span class="tile-label">Access requests</span><span class="tile-num">{{ access_requests }}</span><span class="tile-delta"><a href="/dashboard/users">review requests</a></span></div>
 </div>
 
 <div class="cards">

src/web/templates/dashboard/users.html

@@ -1,9 +1,19 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard">
 <header class="page-head"><div>
 <h1>Users</h1>
-<p class="page-desc">Every account on this server, with its role and open sessions.</p>
+<p class="page-desc">{{ requests.len() }} open access request{% if requests.len() != 1 %}s{% endif %}; every account on this server, with its role and open sessions.</p>
 </div></header>
-<p class="muted text-sm">Accounts are read-only here. Create, change, disable, enable, or sign out users with the <code>daily-epub users</code> CLI on the server.</p>
+<p class="muted text-sm">Create accounts with <code>daily-epub users add &lt;username&gt;</code> on the server, then mark the request done. Change, disable, enable, or sign out users with the <code>daily-epub users</code> CLI.</p>
+<section class="card"><h2>Access requests</h2>
+{% if requests.is_empty() %}<p class="muted">No open requests.</p>{% else %}<div class="scroll-x"><table>
+<thead><tr><th>Email</th><th>Reason or comment</th><th>Requested</th><th><span class="sr-only">Action</span></th></tr></thead>
+<tbody>{% for request in requests %}<tr>
+<td class="font-medium text-ink"><a href="mailto:{{ request.email }}">{{ request.email }}</a></td>
+<td class="cell-wrap">{% if request.reason.is_empty() %}<span class="text-muted">—</span>{% else %}{{ request.reason }}{% endif %}</td>
+<td class="cell-tight text-muted">{{ request.requested }}</td>
+<td><form method="post" action="/dashboard/users/requests/{{ request.id }}/done"><button class="btn" type="submit">Mark done</button></form></td>
+</tr>{% endfor %}</tbody></table></div>{% endif %}
+</section>
 {% if users.len() > 1 %}<input type="search" class="table-filter" placeholder="Filter rows on this page" aria-label="Filter rows on this page" data-table-filter>{% endif %}<div class="scroll-x tall"><table data-filter>
 <thead><tr><th>Username</th><th>Role</th><th>Status</th><th>Created</th><th>Last login</th><th class="num">Open sessions</th></tr></thead>
 <tbody>{% for user in users %}<tr>