fix: enforce gallery access and consolidate gallery workflows

Apply shared session, permission, ownership and lifecycle checks across
gallery access, media grants and session restoration. Validate mutation
origins, pin webhook DNS resolution and redact token-bearing request URLs.

Consolidate gallery creation and queries, extract frontend state hooks,
fix hook ordering and resource cleanup, and repair the fresh event schema.
Update affected dependencies and restore excluded CI suites with regression
and cross-database coverage.

.github/workflows/tests.yml

@@ -6,11 +6,6 @@ name: Tests
 # calendar) plus the photo / settings / OG / auth surface — wiring them
 # into CI makes regressions visible at PR time instead of post-merge.
 #
-# Six backend suites are excluded via --testPathIgnorePatterns. They
-# fail on `upstream/beta` too (pre-existing mock/infra issues, NOT CRM
-# regressions). Excluding them here keeps CI green from day 1; revisit
-# each individually as its own fix.
-#
 # Triggers on any change that could affect either suite. The backend
 # job intentionally omits frontend paths and vice versa so unrelated
 # PRs don't pay both build costs.
@@ -89,18 +84,7 @@ jobs:
           # Un-gates the real-Postgres cases in the .picpeak restore suites
           # (see the `services:` note above). Absent it they silently skip.
           PICPEAK_PG_TEST_URL: 'postgres://picpeak:[email protected]:5432/picpeak_test'
-        run: |
-          # Excluded suites — fail on upstream/beta too, tracked
-          # separately as test-infra debt:
-          #   adminSettings.logo                  — supertest fixture
-          #   integration/adminPhotos.reference   — supertest fixture
-          #   integration/webhookDelivery         — supertest fixture
-          #   services/backupService.enhanced     — knex mock chain
-          #   routes/__tests__/adminAuth          — supertest fixture
-          # (adminNotifications was excluded; #597 fix re-enables it.)
-          npx jest \
-            --testPathIgnorePatterns='/node_modules/|adminSettings\.logo\.test|integration/adminPhotos\.reference|integration/webhookDelivery|backupService\.enhanced|routes/__tests__/adminAuth' \
-            --ci
+        run: npx jest --ci
 
   frontend:
     runs-on: ubuntu-latest
@@ -121,6 +105,10 @@ jobs:
         working-directory: ./frontend
         run: npm ci
 
+      - name: Lint frontend (including Rules of Hooks)
+        working-directory: ./frontend
+        run: npm run lint
+
       - name: Run Vitest suite
         working-directory: ./frontend
         run: npm test -- --run