Gate admin routes behind auth and add copy guest link button

When auth is enabled, admin pages require the logged-in user to be
the event owner — unauthorized visitors get redirected to the guest
view, and admin actions return 403. Also adds a copy-to-clipboard
button in the admin bar and a Makefile for common commands.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

auth.go

@@ -109,7 +109,7 @@ func (s *Server) handleLoginSubmit(w http.ResponseWriter, r *http.Request) {
 	}
 
 	code := generateCode()
-	expiresAt := time.Now().Add(10 * time.Minute)
+	expiresAt := time.Now().UTC().Add(10 * time.Minute)
 	s.q.CreateVerificationCode(r.Context(), db.CreateVerificationCodeParams{
 		Identifier: identifier,
 		Code:       code,
@@ -177,7 +177,7 @@ func (s *Server) handleVerifyCode(w http.ResponseWriter, r *http.Request) {
 
 	// Create session
 	token := generateSessionToken()
-	expiresAt := time.Now().Add(30 * 24 * time.Hour) // 30 days
+	expiresAt := time.Now().UTC().Add(30 * 24 * time.Hour) // 30 days
 	s.q.CreateSession(r.Context(), db.CreateSessionParams{
 		Token:     token,
 		UserID:    user.ID,