Write a form-error page's status only after it renders (closes #128)

Six form-error paths (the login error and the webhook form's validation and name-taken branches) called WriteHeader before rendering, so if the form page's own template failed, the answer kept its 400 or 409 status with an error body instead of a 500. The new renderTemplateStatus renders into the buffer and writes the status only after the page has rendered; renderTemplate sends 200 through it, and those handlers pass their status to it. No handler calls WriteHeader before a render. Login-form tests show the 400 page still renders in full and a failing template answers 500.

Model: opus-5-5

internal/handlers/auth.go

@@ -139,8 +139,7 @@ func (h *Handlers) renderLoginError(
 		),
 	}
 
-	w.WriteHeader(status)
-	h.renderTemplate(w, r, "login.html", data)
+	h.renderTemplateStatus(w, r, "login.html", data, status)
 }
 
 // authenticateUser looks up and verifies a user's credentials.