refactor: extract API handlers into internal packages

Move HTTP handler logic out of main into internal api and server packages,
slimming main to a thin entrypoint. Bundles bug fixes: login nil-panic,
empty-password validation, chirp sort ordering, duplicate-email 409, and
restricting the file server to the assets directory.

internal/server/profanity_test.go

@@ -0,0 +1,47 @@
+package server
+
+import "testing"
+
+func TestCleanProfanity(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "no profanity",
+			input:    "hello world",
+			expected: "hello world",
+		},
+		{
+			name:     "case insensitive",
+			input:    "That was a KERFUFFLE",
+			expected: "That was a ****",
+		},
+		{
+			name:     "not a substring match",
+			input:    "kerfuffling away",
+			expected: "kerfuffling away",
+		},
+		{
+			name:     "multiple words",
+			input:    "sharbert fornax",
+			expected: "**** ****",
+		},
+		{
+			name:     "empty body",
+			input:    "",
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := cleanProfanity(tt.input)
+
+			if got != tt.expected {
+				t.Errorf("cleanProfanity(%q) = %q, want %q", tt.input, got, tt.expected)
+			}
+		})
+	}
+}