Run the SPA without a backend (local mode)

The app can now operate backend-agnostically: a production build still
asks on first start, but /setup also offers 'Continue without a backend'
(stored as the sentinel 'none'), and the shell adapts:

- Local mode shows only the e621-facing pages: Online (search, post view,
  favorites, blacklist editor, direct downloads) and Pools. Library,
  uploads, duplicates, stats, users, follows and similarity are hidden
  from the nav and palette and render a 'backend needed' state when
  reached directly; /detail/<e621 id> still works while /detail/J-x asks
  for a backend.
- e621 credentials are stored in this browser (j621.e621) and the
  Account page becomes a credentials-only screen; the store reads/writes
  locally instead of /api/auth/e621/.
- The header replaces the status pill and login/user area with an e621
  credentials button and a 'Setup Backend' button; the footer shows
  'Local mode — e621 features only' with the same entry point.
- In-library lookups (badges/browse markers) are skipped without a
  backend; 'Download to client' links straight to the e621 file instead
  of the backend proxy; follow buttons and palette follow toggles are
  hidden; api() fails fast with a clear message if something slips
  through.

Mode logic lives in lib/backend.ts (URL / '' same-origin / 'none') with
its matrix verified in Node; tsc, oxlint and the build are clean.

AGENTS.md

@@ -31,13 +31,17 @@ Project constraints (do not regress):
   MariaDB/Redis come from docker-compose.yml.
 - Deployment will be Docker-based (compose); do not add systemd/cron unit
   files for scheduling — use the container setup for timers/workers.
-- Same-origin and cross-origin frontends both work: a production build asks
-  for the backend origin on first start (/setup, stored in localStorage;
-  DEFAULT_BACKEND_URL in frontend/src/lib/backend.ts is the prefilled
-  default), the backend allows extra origins via CORS_ALLOWED_ORIGINS (plus
-  CSRF_TRUSTED_ORIGINS for the admin), and API media URLs are absolute
-  (built from the request host), so signed files load cross-origin too.
-  TRUST_PROXY_HEADERS=true is required behind a TLS-terminating proxy.
+- Same-origin and cross-origin frontends both work, and the SPA can also run
+  with no backend at all: a production build asks on first start (/setup) and
+  stores the answer in localStorage — a URL, "" for same origin, or "none"
+  for local mode. Local mode shows only the e621-facing pages (Online, Pools)
+  with credentials kept in this browser (j621.e621) and a "Setup Backend"
+  button in the shell. DEFAULT_BACKEND_URL in frontend/src/lib/backend.ts is
+  the prefilled default; the backend allows extra origins via
+  CORS_ALLOWED_ORIGINS (plus CSRF_TRUSTED_ORIGINS for the admin), and API
+  media URLs are absolute (built from the request host), so signed files load
+  cross-origin too. TRUST_PROXY_HEADERS=true is required behind a
+  TLS-terminating proxy.
 - No server-side media processing: the home server cannot handle it.
   Compression/optimization runs client-side (WebCodecs + WASM in a worker)
   and the server only applies the result via POST /api/files/J-x/optimize/.