Add stats, profiles, avatars and palaute

Step 6. The surfaces around the review loop.

- Nine leaderboards, ordered and limited in SQL, each with a deterministic
  tie-break so a tied board doesn't reshuffle between reloads. Min 3 reviews
  to qualify, for reviewer boards too
- Profiles show counts and history-wide averages and the member's songs,
  never a list of their reviews — per-song opinion stays gated
- Avatars: 5MB in, 256px JPEG out, ffmpeg's re-encode being the validation.
  No upload still means initials, and avatars are public
- Changing your own password requires the current one and drops your other
  sessions
- Palaute: free text plus the page you were on, carried in a footer link, and
  the user agent from the header. Reporters see their own; the admin resolves
  them with a timestamp rather than a status enum
- Admin gained the song list with delete, the reports page, and an open-report
  count on the dashboard

Two theme fixes the screenshots caught: leaderboard ranks need a CSS counter
because display:grid suppresses list markers, and count-based boards were
printing 3.0 where they mean 3.

admin.go

@@ -29,8 +29,10 @@ type adminMember struct {
 }
 
 type dashboard struct {
-	Invites []adminInvite
-	Members []adminMember
+	Invites   []adminInvite
+	Members   []adminMember
+	Songs     []adminSong
+	OpenCount int
 }
 
 func (a *app) adminDashboard(w http.ResponseWriter, r *http.Request) {
@@ -77,6 +79,16 @@ func (a *app) adminDashboard(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if d.Songs, err = a.adminSongs(r.Context()); err != nil {
+		adminError(w, "songs", err)
+		return
+	}
+	if err := a.pool.QueryRow(r.Context(),
+		`select count(*)::int from reports where resolved_at is null`).Scan(&d.OpenCount); err != nil {
+		adminError(w, "reports", err)
+		return
+	}
+
 	a.render(w, r, http.StatusOK, "admin.html", page{Title: "Ylläpito", Admin: true, Data: d})
 }