fix(webserver): serve static .css/.js files to unauthenticated clients - #97

ProcessURL() unconditionally rewrote every request from a session that
is not logged in to login.php, so a logged-out browser asking for
style.css got login-page HTML with the wrong Content-Type. The login
page itself was therefore unable to use the shared stylesheet and had
to carry an inline copy of every rule it needs.

Treat stylesheets and scripts as public static assets, exactly like
the template images that ProcessImgFileReq() already serves without a
login, and skip the login.php override for them. This is safe: path
components are stripped from the request and resolved against the
template root, only names ending in .css/.js take the new path, and
they are served statically with the right Content-Type -- the PHP
interpreter is never involved, so no template source can leak. Other
extensions still get the login page, and a missing file still yields
the 404 page.

With style.css reachable before login, drop the inline <style> block
from login.php -- a forced duplicate of style.css rules -- and move
the one rule that lived nowhere else (.login-error, the white-on-red
failed-login badge) into style.css.

Verified against the rebuilt amuleweb: curl without a session gets
style.css as text/css while .php pages still return the login page,
and headless-Chromium screenshots of the unauthenticated login page
and of the wrong-password error state are pixel-identical to before.