pastes: add display_name field

Authenticated users can tag pastes with a human-readable label
via X-Display-Name header. Supports create, update, remove, and
listing. Max 128 chars, control characters rejected.

app/database.py

@@ -28,7 +28,8 @@ CREATE TABLE IF NOT EXISTS pastes (
     last_accessed INTEGER NOT NULL,
     burn_after_read INTEGER NOT NULL DEFAULT 0,
     expires_at INTEGER,
-    password_hash TEXT
+    password_hash TEXT,
+    display_name TEXT
 );
 
 CREATE INDEX IF NOT EXISTS idx_pastes_created_at ON pastes(created_at);