fix(gallery): show a guest their own likes when feedback sharing is off (#1286)

show_feedback_to_guests means "don't show guests OTHER PEOPLE's feedback".
The per-viewer is_liked flag was gated on it anyway, so turning sharing
off emptied every heart the guest had set themselves, on every page load,
while the photo_feedback rows sat there intact.

The query behind the flag is filtered to the viewer (by guest_id, or by
their own IP+UA identifier), so what it returns was never aggregate data.
The colour-label block twelve lines below already documents this exact
reasoning and is correctly ungated.

Scope is just that flag — the counts beside it stay gated, with a test
pinning that the fix does not leak them back. The #1150 contract still
holds: an admin-hidden like does not read as liked.

Note for the reporter: the FILTER path was already correct
(includeGuestMatches is ungated, /my-feedback carries no gate). The empty
Likes chip was downstream of the same falsified flag, not a second bug.

Closes #1286

backend/src/routes/gallery.js

@@ -1022,10 +1022,17 @@ router.get('/:slug/photos', verifyGalleryAccess, resolveGuest, noStoreCache, asy
     // frontend can seed correctly. Prefers req.guest.id when a verified
     // guest token is present (per-person identity), falls back to the
     // IP+UA hash that the original like was recorded under — same model
-    // the /my-feedback endpoint uses. Skipped when feedback is hidden
-    // from guests.
+    // the /my-feedback endpoint uses.
+    //
+    // NOT gated on showFeedbackToGuests (#1286). This query is filtered to
+    // the VIEWER — by guest_id or by their own identifier — so what it
+    // returns is their own selection, not shared aggregate data. Gating it
+    // emptied every heart the guest had set themselves on a gallery with
+    // sharing off, which reads as the gallery silently discarding their
+    // choices. Same reasoning the colour-label block below already applies;
+    // this was the one per-viewer field that disagreed with it.
     const likedPhotoIds = new Set();
-    if (showFeedbackToGuests && photos.length > 0) {
+    if (photos.length > 0) {
       const likeQuery = db('photo_feedback')
         // Hidden rows are not there, for the viewer's OWN feedback as much as
         // anyone's (#1150). getPhotoFeedback drops them, the filter drops them
@@ -1405,7 +1412,9 @@ router.get('/:slug/photos', verifyGalleryAccess, resolveGuest, noStoreCache, asy
           // Per-viewer flag (#590 follow-up) — true when this viewer has
           // an active like row for this photo, false otherwise. Lets the
           // grid seed its lifted likedPhotoIds correctly on hard refresh.
-          is_liked: showFeedbackToGuests ? likedPhotoIds.has(photo.id) : false,
+          // Survives show_feedback_to_guests being off (#1286): the viewer's
+          // own heart is theirs, and the like_count beside it stays hidden.
+          is_liked: likedPhotoIds.has(photo.id),
           favorite_count: showFeedbackToGuests ? (photo.favorite_count || 0) : 0,
           // Colour labels (#1044). The COUNT is aggregate data and follows
           // show_feedback_to_guests like its siblings; the viewer's OWN label