Password protection for blogs

[lylo]

What

Adds whole-blog password protection. A blog owner can set a password in settings; visitors must enter it before they can read any posts or pages. Useful for private family journals or travelogues.

Distinct from the existing hidden flag on posts, which only unlists a post (the URL still serves to anyone). This is a real access gate.

How

• password_digest column on blogs; Blog uses has_secure_password (no length validation, so a visitor password need not meet the 12-char account rule).
• Blogs::BaseController#require_blog_password redirects protected blogs to a themed /unlock page (rendered in the blog's own theme).
• On the correct password, an encrypted, per-host cookie stores the blog's password_digest. Because the cookie is the digest, changing or removing the password auto-invalidates every existing unlock. No session dependency, so it works even though blog pages skip the session cookie for edge caching.
• Protected blogs skip Cloudflare edge caching, so locked content is never served publicly.
• Owners set / change / remove the password from blog settings (a "Remove password protection" checkbox clears it).

Notes / trade-offs

• The owner also hits the gate on their own blog host (owner sessions only run on the app domain). Acceptable, no bypass.
• Feeds/sitemap/robots on a protected blog also redirect to the unlock page. Correct for a private blog, but RSS won't work while locked.
• Currently available on all tiers. Easy to gate behind a subscription later if desired.

Tests

Model (password_protected?, blank-is-noop, nil-clears), unlock controller (gating, correct/wrong password, cookie invalidation on password change, local-only redirect), and settings set/remove. Full blogs controller suite green.