The structured contents API requires a POST request with the filter
in the JSON body to narrow results:
  {"filters": [{"field": "in_language.identifier", "value": "en"}]}

Replaces the non-functional query-string filter parameter.

The filters[project]=en.wikipedia.org parameter caused timeouts and
empty responses. The filter value was incorrect for the Wikimedia
Enterprise API.

Articles from 404-list.test that genuinely don't exist on Wikipedia
(e.g. TV episodes without standalone articles) still return 404 —
this is expected behavior from the upstream API.

- Non-2xx responses (404, 429, 5xx) are now forwarded to the
  client with their original status code and response body
- Increased WriteTimeout to 45s to accommodate slow upstream API
- Added explicit resp.Body.Close() and response flush before return

- Created api_logs table (username, article_name, status_code,
  response_time_ms, error, request_url)
- GetArticle logs failures (network errors and non-2xx responses)
  with timing, status code, and response body
- Successful requests are not logged

Add limit=1&filters[project]=en.wikipedia.org to structured
contents API call.

GET /article?username=alice&name=en.wikipedia/Sun
→ proxies to api.enterprise.wikimedia.com/v2/structured-contents/{name}
with Authorization: Bearer <access_token>

Returns 401 for unknown users, 400 if params missing,
and passes through the upstream HTTP status on errors.

Returns access_token and valid_until for a given username.
GET /token?username=foo → {"access_token": "...", "valid_until": "2026-06-26T15:00:51Z"}

Returns the stored access_token and the timestamp when it was
created (access_token_created). Returns 401 for unknown users.

- RefreshTokens checks token age and chooses the right path:
  - refresh_token > 90 days: re-auth via WikimediaLogin (full login)
  - access_token > 24 hours: refresh via WikimediaTokenRefresh
  - otherwise: return current tokens
- WikimediaTokenRefresh posts to /v1/token-refresh endpoint
- Login also uses WikimediaLogin instead of local RotateTokens
- Removed dead RotateTokens, RefreshByToken, and randomHex
- DSN includes parseTime=true for timestamp columns

- WikimediaLogin is a standalone function: POSTs to auth.enterprise.wikimedia.com
  and returns the tokens. Can be called from any flow.
- Register composes WikimediaLogin + CreateAccount
- CreateAccount now takes tokens as arguments (pure DB insert)