Add stats, profiles, avatars and palaute

Step 6. The surfaces around the review loop.

- Nine leaderboards, ordered and limited in SQL, each with a deterministic
  tie-break so a tied board doesn't reshuffle between reloads. Min 3 reviews
  to qualify, for reviewer boards too
- Profiles show counts and history-wide averages and the member's songs,
  never a list of their reviews — per-song opinion stays gated
- Avatars: 5MB in, 256px JPEG out, ffmpeg's re-encode being the validation.
  No upload still means initials, and avatars are public
- Changing your own password requires the current one and drops your other
  sessions
- Palaute: free text plus the page you were on, carried in a footer link, and
  the user agent from the header. Reporters see their own; the admin resolves
  them with a timestamp rather than a status enum
- Admin gained the song list with delete, the reports page, and an open-report
  count on the dashboard

Two theme fixes the screenshots caught: leaderboard ranks need a CSS counter
because display:grid suppresses list markers, and count-based boards were
printing 3.0 where they mean 3.

templates/admin_reports.html

@@ -0,0 +1,23 @@
+{{define "content"}}
+<h1>Palautteet</h1>
+<p><a href="/admin">← Ylläpito</a></p>
+
+{{range .Data}}
+  <article class="review{{if .Open}} own{{end}}">
+    <header>
+      <span class="badge {{if .Open}}pending{{else}}reviewed{{end}}">{{if .Open}}avoin{{else}}käsitelty{{end}}</span>
+      <span class="who">{{.Reporter}}</span>
+      <span class="meta">{{fidate .CreatedAt}}{{if .Page}} · {{.Page}}{{end}}</span>
+    </header>
+    <p>{{.Body}}</p>
+    <p class="meta break">{{.UserAgent}}</p>
+    {{if .Open}}
+      <form method="post" action="/admin/reports/{{.ID}}/resolve">
+        <button type="submit" class="ghost">Merkitse käsitellyksi</button>
+      </form>
+    {{end}}
+  </article>
+{{else}}
+  <p class="empty">Ei palautteita.</p>
+{{end}}
+{{end}}