Add announcements, and record when members last logged in

A single place to say "downloads work again" without messaging everyone.
The body is markdown, stored as typed and rendered on the way out, so a post
survives editing without a lossy round trip through HTML. goldmark drops raw
HTML rather than rendering it, which matters because the body reaches the
page through template.HTML with Go's own escaping switched off.

The front page carries the three newest under the queue, newest expanded,
and links to /news only when there is a fourth. News is decoration there: if
the query fails the queue still renders. Drafts exist so a post can be
written before it is sent, and hiding is the same toggle as publishing.

Ages read as "5 minuuttia sitten" for a week and then become a date, since
past that the exact age stops being the interesting part.

last_login_at is unrelated to the feed — it answers "does anyone actually
use this", and stays null until a real login, which is how an unused invite
shows up in the members table.

Ago and HTML take value receivers on purpose: templates reach them through
dict, which boxes the item in an interface, and a pointer method on a
non-addressable value is invisible there. That failure renders as a 500 and
is invisible to go vet, so TestFrontPageRendersNews renders the real page.

README.md

@@ -110,7 +110,22 @@ An admin is **an ordinary member with `is_admin` set** — the same account, the
 session cookie. Admins submit and review like anyone else; the flag adds a Ylläpito link to the nav
 and unlocks `/admin` on the normal listener. A signed-in member without the flag gets a 404 there.
 
-From `/admin`: mint invites, reset member passwords, ban members, delete songs, read issue reports.
+From `/admin`: mint invites, reset member passwords, ban members, delete songs, read issue reports,
+post announcements, and see when each member last logged in.
+
+## Announcements
+
+`/admin` has a plain title-and-textarea form. The body is **markdown**, stored exactly as typed and
+rendered on the way out, so a post can be edited without a lossy round trip through HTML. Raw HTML
+in a post is dropped rather than rendered — the parser is [goldmark](https://github.com/yuin/goldmark)
+with the unsafe option deliberately off.
+
+A post is published unless *Tallenna luonnoksena* is ticked. Draft and published is one toggle
+afterwards, so something that went out too early can be pulled back without losing the text.
+
+Members see the three newest on the front page under the queue, newest expanded, with the rest on
+`/news`. Reading requires login, like everything else. Timestamps are relative for the first week
+(*5 minuuttia sitten*, *eilen*, *3 päivää sitten*) and a plain date after that.
 
 An admin cannot ban themselves, since banning drops every session for the target and nothing would
 be left to undo it.