refactor: extract API handlers into internal packages

Move HTTP handler logic out of main into internal api and server packages,
slimming main to a thin entrypoint. Bundles bug fixes: login nil-panic,
empty-password validation, chirp sort ordering, duplicate-email 409, and
restricting the file server to the assets directory.

internal/server/profanity.go

@@ -0,0 +1,22 @@
+package server
+
+import (
+	"slices"
+	"strings"
+)
+
+var profaneWords = []string{"kerfuffle", "sharbert", "fornax"}
+
+// cleanProfanity replaces profane words with asterisks, case-insensitively,
+// matching on whole words only.
+func cleanProfanity(body string) string {
+	words := strings.Split(body, " ")
+
+	for i, word := range words {
+		if slices.Contains(profaneWords, strings.ToLower(word)) {
+			words[i] = "****"
+		}
+	}
+
+	return strings.Join(words, " ")
+}