Fix brand theme application and add comprehensive translations

- Fixed theme not being reflected on gallery and admin login pages
- Created GlobalThemeProvider to apply themes globally
- Updated gallery and admin login pages to use dynamic CSS variables
- Added complete translations for all admin sections in English and German:
  - Notifications management
  - Event view and creation
  - Photo upload functionality
  - Category management
  - Archive page view
  - Analytics dashboard
  - Branding and theme settings
  - System settings
  - CMS page management
  - Email configuration
- Fixed admin photo management display issues
- Fixed photo upload category assignment
- Added password reset functionality for galleries
- Improved error handling and user feedback

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/middleware/sessionTimeout.js

@@ -0,0 +1,122 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+
+// In-memory session tracking (in production, use Redis)
+const sessions = new Map();
+
+// Default session timeout (60 minutes)
+const DEFAULT_SESSION_TIMEOUT = 60 * 60 * 1000;
+
+// Clean up expired sessions every 5 minutes
+setInterval(() => {
+  const now = Date.now();
+  for (const [token, lastActivity] of sessions.entries()) {
+    if (now - lastActivity > DEFAULT_SESSION_TIMEOUT) {
+      sessions.delete(token);
+    }
+  }
+}, 5 * 60 * 1000);
+
+async function getSessionTimeout() {
+  try {
+    const setting = await db('app_settings')
+      .where('setting_key', 'security_session_timeout_minutes')
+      .first();
+    
+    if (setting && setting.setting_value) {
+      const minutes = parseInt(JSON.parse(setting.setting_value));
+      return minutes * 60 * 1000; // Convert to milliseconds
+    }
+  } catch (error) {
+    console.error('Error getting session timeout:', error);
+  }
+  
+  return DEFAULT_SESSION_TIMEOUT;
+}
+
+async function sessionTimeoutMiddleware(req, res, next) {
+  // Skip for non-authenticated routes
+  if (!req.headers.authorization) {
+    return next();
+  }
+  
+  const token = req.headers.authorization.split(' ')[1];
+  if (!token) {
+    return next();
+  }
+  
+  try {
+    // Verify token is valid
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    
+    // Check if this is an admin token
+    if (!decoded.id) {
+      return next();
+    }
+    
+    const now = Date.now();
+    const lastActivity = sessions.get(token);
+    const timeout = await getSessionTimeout();
+    
+    // If session exists, check if it's expired
+    if (lastActivity) {
+      if (now - lastActivity > timeout) {
+        sessions.delete(token);
+        return res.status(401).json({ 
+          error: 'Session expired', 
+          code: 'SESSION_TIMEOUT' 
+        });
+      }
+    }
+    
+    // Update last activity
+    sessions.set(token, now);
+    
+    // Clean up old token if user has a new one
+    // This prevents memory leaks from token renewals
+    const userId = decoded.id;
+    for (const [oldToken, _] of sessions.entries()) {
+      if (oldToken !== token) {
+        try {
+          const oldDecoded = jwt.verify(oldToken, process.env.JWT_SECRET);
+          if (oldDecoded.id === userId) {
+            sessions.delete(oldToken);
+          }
+        } catch (e) {
+          // Token is invalid, remove it
+          sessions.delete(oldToken);
+        }
+      }
+    }
+    
+    next();
+  } catch (error) {
+    // Token is invalid
+    next();
+  }
+}
+
+// Function to end a session
+function endSession(token) {
+  sessions.delete(token);
+}
+
+// Function to get active sessions count
+function getActiveSessions() {
+  const now = Date.now();
+  let active = 0;
+  
+  for (const [_, lastActivity] of sessions.entries()) {
+    if (now - lastActivity <= DEFAULT_SESSION_TIMEOUT) {
+      active++;
+    }
+  }
+  
+  return active;
+}
+
+module.exports = { 
+  sessionTimeoutMiddleware, 
+  endSession,
+  getActiveSessions 
+};