security: enforce auth on all API write endpoints, remove mario-kart

- Remove all mario-kart routes and model (zero auth, unused)
- Add requireGroup() helper to auth middleware
- Recipe write APIs (add/edit/delete/img/*): require rezepte_users group
- Translate endpoint: require rezepte_users (was fully unauthenticated)
- Nutrition overwrites: require auth (was no-op)
- Nutrition generate-all: require rezepte_users (was no-op)
- Alt-text/color endpoints: require rezepte_users group
- Image delete/mv: add path traversal protection
- Period shared endpoint: normalize username for consistent lookup

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "homepage",
-	"version": "1.4.4",
+	"version": "1.5.0",
 	"private": true,
 	"type": "module",
 	"scripts": {