fix: enforce gallery access and consolidate gallery workflows

Apply shared session, permission, ownership and lifecycle checks across
gallery access, media grants and session restoration. Validate mutation
origins, pin webhook DNS resolution and redact token-bearing request URLs.

Consolidate gallery creation and queries, extract frontend state hooks,
fix hook ordering and resource cleanup, and repair the fresh event schema.
Update affected dependencies and restore excluded CI suites with regression
and cross-database coverage.

frontend/nginx.dev.conf

@@ -1,3 +1,11 @@
+    # URLs and Referer can contain gallery, image and customer bearer tokens.
+    map $uri $request_surface {
+        ~*^/api/(?<picpeak_surface>[a-z-]+)(?:/|$) /api/$picpeak_surface;
+        default /;
+    }
+    log_format picpeak_safe '$remote_addr [$time_local] "$request_method $request_surface" '
+                            '$status $body_bytes_sent $request_time';
+
 # Honour outer reverse-proxy's X-Forwarded-Proto when present (see #547 /
 # frontend/nginx.conf for full rationale).
 map $http_x_forwarded_proto $real_proto {
@@ -6,6 +14,9 @@ map $http_x_forwarded_proto $real_proto {
 }
 
 server {
+    access_log /var/log/nginx/access.log picpeak_safe;
+    # Request error logs expose raw token URLs; use safe access statuses.
+    error_log /dev/null;
     listen 80;
     server_name localhost;
     root /usr/share/nginx/html;