fix(og): route branded short URLs + slideshow links to OG, add Viber (#699)

Follow-up to #699/#700/#702 — the OG SSR handler existed but three link
shapes never reached it behind the frontend nginx:

- Branded short URLs (/s/<slug>, #702) had NO nginx location, so they fell
  through to the SPA — which has no /s/ route. Dead for humans (no 302
  redirect) and crawlers (no OG). Add an ^~ /s/ proxy to the backend, whose
  /s/:shortSlug route already handles both.
- Slideshow links (/gallery/<slug>/show/<token>) have TWO extra path
  segments; the crawler-detect location regex allowed only one, so they
  never rewrote to /og and got generic site-wide OG. Widen to {0,2} extra
  segments (quoted regex — the braces would otherwise be parsed as nginx
  config delimiters). client-access still matches (its token is in ?query,
  one path segment).
- Viber's preview fetcher wasn't in either UA list, so Viber shares showed
  no preview. Add it to nginx + SOCIAL_CRAWLER_PATTERNS (kept in sync).

Verified end-to-end: nginx -t passes; a live nginx+mock-backend harness
confirms /s/ proxies to the backend, slideshow + Viber + share-token +
client-access crawler UAs all rewrite to /og/gallery/<slug>, and browsers
still get the SPA. Backend isSocialCrawler test extended for Viber.

frontend/nginx.conf

@@ -237,12 +237,22 @@ server {
     # Facebook, Slack, Twitter, etc.) don't run JS, so the SPA's client-side
     # meta tags never reach them. Route those UAs to backend's /og handler
     # via internal rewrite; humans fall through to the SPA via try_files.
-    location ~ ^/gallery/(?<gallery_slug>[A-Za-z0-9_-]+)(?:/[^/]+)?/?$ {
+    # {0,2} extra path segments so the deeper gallery share shapes match too:
+    #   /gallery/<slug>                      (public / share-token link)
+    #   /gallery/<slug>/client-access        (client-access; token is in ?query)
+    #   /gallery/<slug>/show/<token>          (slideshow; token is a PATH segment)
+    # The slideshow shape has TWO extra segments (show + token) — the old
+    # single-segment `(?:/[^/]+)?` never matched it, so slideshow links fell
+    # through to the SPA and got only the generic site-wide OG (#699 follow-up).
+    # NB: the regex is QUOTED because the {0,2} quantifier's braces would
+    # otherwise be parsed as nginx config block delimiters.
+    location ~ "^/gallery/(?<gallery_slug>[A-Za-z0-9_-]+)(?:/[^/]+){0,2}/?$" {
         # Keep this list in sync with SOCIAL_CRAWLER_PATTERNS in
         # backend/src/services/galleryOgService.js. WhatsAppBot / wa-bot
         # and LinkPreview / Slack-ImgProxy added in #521 to catch
         # business-API preview fetchers that aren't the main WhatsApp app.
-        if ($http_user_agent ~* "(facebookexternalhit|facebot|Twitterbot|WhatsApp|WhatsAppBot|wa-bot|Slackbot|Slack-ImgProxy|TelegramBot|SkypeUriPreview|Discordbot|LinkedInBot|Pinterest|vkShare|redditbot|Embedly|iframely|Snapchat|Applebot|Mastodon|Bluesky|OpenGraph|LinkPreview)") {
+        # Viber added in #699 follow-up (its preview fetcher was never detected).
+        if ($http_user_agent ~* "(facebookexternalhit|facebot|Twitterbot|WhatsApp|WhatsAppBot|wa-bot|Slackbot|Slack-ImgProxy|TelegramBot|SkypeUriPreview|Discordbot|LinkedInBot|Pinterest|vkShare|redditbot|Embedly|iframely|Snapchat|Applebot|Mastodon|Bluesky|OpenGraph|LinkPreview|Viber)") {
             rewrite ^ /og/gallery/$gallery_slug last;
         }
         try_files $uri $uri/ /index.html;
@@ -260,6 +270,22 @@ server {
         proxy_set_header X-Forwarded-Proto $real_proto;
     }
 
+    # Branded URL shortener (#699). The backend `/s/<short_slug>` route both
+    # 302-redirects humans to the target gallery AND server-renders OG for
+    # social crawlers. Without this proxy, `/s/...` fell through to the SPA
+    # (which has no /s/ route) — so branded short links were dead for humans
+    # and crawlers alike. `^~` beats the regex SPA fallback below. The backend
+    # does its own UA detection, so no crawler `if` is needed here.
+    location ^~ /s/ {
+        set $backend_upstream backend;
+        proxy_pass http://$backend_upstream:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $real_proto;
+    }
+
     # SPA fallback
     location / {
         try_files $uri $uri/ /index.html;