fix(security): close cross-event thumbnail leak, bulk-op ownership bypass, + hardening

Auth/access-control audit fixes (all pre-existing on main; none are
regressions). Verified end-to-end where noted.

HIGH
- Thumbnail enumeration: photoAuth granted any gallery token access to any
  flat /thumbnails/thumb_* file, so a visitor to one gallery could
  enumerate another (password-protected) gallery's entire thumbnail set.
  Scope thumbnail access to the token's event via photos.thumbnail_path.
  Live-verified: cross-event fetch now 404s, own-event still 200s.
- Bulk ownership bypass: bulk-archive/bulk-delete acted on body-supplied
  event ids with no owner filter (single-event routes enforce
  requireEventOwnership), letting admin/editor archive or cascade-delete
  any event. Add filterOwnedEventIds; also guard rename + import-external;
  tighten photo-retry to scope admin (not just editor). Fix misleading
  bulk-delete comment.

MED
- verifyGalleryAccess never checked decoded.type — assert 'gallery'
  instead of relying on other token types incidentally lacking eventId.
- secure-images generate-token/secure-download missing denySlideshowToken
  (#646 bypass): a leaked slideshow token could download originals.
- Frontend: AuthenticatedImage + api.ts attached the gallery bearer token
  to absolute/external URLs — only attach to relative same-app paths.

LOW hardening
- Pin algorithms:['HS256'] on all auth-boundary jwt.verify calls.
- crypto.timingSafeEqual for share-token + HMAC compares (utils/timingSafe).
- Remove dead photoAuth import in galleryFeedback.

Tests: new regression suites for thumbnail scoping + filterOwnedEventIds;
fixed verifyGalleryAccess.customerRevoke fixture (real customer tokens
carry type:'gallery'). Full backend suite at the pre-existing baseline
(5 suites/27 tests fail on main too), zero new failures.

frontend/src/config/api.ts

@@ -56,11 +56,19 @@ api.interceptors.request.use(
 
       const pathname = rawPath.startsWith('/') ? rawPath : `/${rawPath}`;
 
-      const isGalleryEndpoint = /^\/gallery\//.test(pathname)
-        || /^\/secure-images\//.test(pathname)
-        || /^\/auth\/gallery\//.test(pathname);
+      // Never attach the gallery token to an absolute URL. Requests to the
+      // app's own API use relative paths (axios prepends baseURL); an
+      // absolute URL could point at any origin, and extracting its
+      // `/gallery/...` pathname would otherwise match below and leak the
+      // bearer token cross-origin.
+      const isAbsoluteUrl = /^https?:\/\//i.test(config.url || '');
 
-      const isGallerySessionCheck = pathname === '/auth/session'
+      const isGalleryEndpoint = !isAbsoluteUrl && (
+        /^\/gallery\//.test(pathname)
+        || /^\/secure-images\//.test(pathname)
+        || /^\/auth\/gallery\//.test(pathname));
+
+      const isGallerySessionCheck = !isAbsoluteUrl && pathname === '/auth/session'
         && (!!paramSlug || window.location.pathname.startsWith('/gallery/'));
 
       if (isGalleryEndpoint || isGallerySessionCheck) {