fix: Implement gallery-specific authentication tokens

- Fix issue where different galleries shared authentication
- Store gallery tokens with slug-specific keys in localStorage
- Remove global gallery_token cookie approach
- Each gallery now maintains its own authentication state
- Add cleanup for legacy authentication data

This ensures that accessing different galleries requires separate authentication
and prevents cross-gallery authentication leakage.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/src/config/api.ts

@@ -25,12 +25,22 @@ api.interceptors.request.use(
   (config) => {
     // Check if it's an admin route or gallery route
     const isAdminRoute = config.url?.includes('/admin');
-    const token = isAdminRoute 
-      ? Cookies.get(ADMIN_TOKEN_KEY)
-      : Cookies.get(GALLERY_TOKEN_KEY);
-
-    if (token) {
-      config.headers.Authorization = `Bearer ${token}`;
+    
+    if (isAdminRoute) {
+      const token = Cookies.get(ADMIN_TOKEN_KEY);
+      if (token) {
+        config.headers.Authorization = `Bearer ${token}`;
+      }
+    } else {
+      // For gallery routes, get the slug from the URL path
+      const pathParts = window.location.pathname.split('/');
+      if (pathParts[1] === 'gallery' && pathParts[2]) {
+        const gallerySlug = pathParts[2];
+        const token = localStorage.getItem(`gallery_token_${gallerySlug}`);
+        if (token) {
+          config.headers.Authorization = `Bearer ${token}`;
+        }
+      }
     }
 
     // Don't set Content-Type for FormData - let browser set it with boundary
@@ -63,19 +73,20 @@ api.interceptors.response.use(
     }
     
     if (error.response?.status === 401) {
-      // Clear tokens on unauthorized
-      Cookies.remove(ADMIN_TOKEN_KEY);
-      Cookies.remove(GALLERY_TOKEN_KEY);
-      
       // Redirect to appropriate login
       const isAdminRoute = error.config?.url?.includes('/admin');
       if (isAdminRoute) {
+        // Clear admin token on unauthorized
+        Cookies.remove(ADMIN_TOKEN_KEY);
         window.location.href = '/admin/login';
       } else {
-        // For gallery routes, redirect to the gallery password page
+        // For gallery routes, clear gallery-specific token and redirect
         const currentPath = window.location.pathname;
-        const gallerySlug = currentPath.split('/')[2];
-        if (gallerySlug) {
+        const pathParts = currentPath.split('/');
+        if (pathParts[1] === 'gallery' && pathParts[2]) {
+          const gallerySlug = pathParts[2];
+          localStorage.removeItem(`gallery_token_${gallerySlug}`);
+          localStorage.removeItem(`gallery_event_${gallerySlug}`);
           window.location.href = `/gallery/${gallerySlug}`;
         }
       }