Port 4ducky to Rust (Axum + SQLite)

Same design, layout, URLs and features as the PHP version: browse grid,
image view with AJAX comments, BBCode, likes, uploads (file, URL and
bookmarklet), quicktagger, profile, block list, inbox, invites, Hall of
Ducks, Truhe, abuse reports and the admin tools.

- Parameterized SQL, escaped templates (askama), argon2 passwords,
  server-side sessions, CSRF tokens on every write, strict script CSP
- SSRF-safe remote image fetching, magic-byte upload checks
- Self-hosted captcha replaces reCAPTCHA v1; analytics/social widgets removed
- Vanilla JS replaces jQuery and its plugins with the same DOM behaviour
- Reverse proxy support (frontend_path, trust_proxy, secure_cookies)
- Admin CLI: admin, settings, invites

See README.md for running it and the full list of changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config.example.toml

@@ -0,0 +1,35 @@
+# Copy to config.toml and adjust. Every key is optional; the values below are the defaults.
+
+bind = "127.0.0.1:8080"
+data_dir = "data"                 # uploads, thumbnails, avatars
+database = "data/4ducky.db"       # SQLite file
+secure_cookies = false            # set to true when served over HTTPS
+trust_proxy = false               # use X-Forwarded-For (only behind your own reverse proxy)
+
+frontend_path = "http://www.4ducky.com/"   # absolute URL, used in share codes and the bookmarklet
+site_name = "4ducky"
+site_title = "4ducky.com - fol witzik"
+
+# Spam protection / scores (lib/config.php)
+upload_lock_time = 7200
+max_num_uploads = 50
+post_score = 10
+tag_score_per_char = 0.5
+tag_score_max = 20.0
+
+thumbs_per_page = 125
+users_per_page = 100
+color_search_dev = 50
+max_random_thumbs = 10
+min_random_score = 10.0
+max_download = 8097152
+jpeg_quality = 100
+
+# Who sees the HoF/Ban links on images, and the Unblock link on /manage.
+superadmins = [1]
+unblockers = [1, 11]
+
+# Optional iframe targets for /chat, /forum and /shop (empty = placeholder text).
+chat_url = ""
+forum_url = ""
+shop_url = ""