fix: improve photo authentication middleware for thumbnails

- Add eventId check from JWT token for thumbnail access
- Better error logging for debugging authentication issues
- Add admin debug endpoint to check photo existence
- More permissive thumbnail access when valid gallery token exists

This should help diagnose why photos are returning 404 errors in production.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/routes/adminPhotos.js

@@ -646,4 +646,24 @@ router.get('/:eventId/thumbnail/:photoId', adminAuth, async (req, res) => {
   }
 });
 
+// Debug endpoint to check photo existence
+router.get('/:eventId/debug', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    
+    const event = await db('events').where({ id: eventId }).first();
+    const photoCount = await db('photos').where({ event_id: eventId }).count('id as count').first();
+    const photos = await db('photos').where({ event_id: eventId }).limit(5);
+    
+    res.json({
+      event: event || 'Not found',
+      photoCount: photoCount.count,
+      samplePhotos: photos,
+      storagePath: getStoragePath()
+    });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
 module.exports = router;