fix: enforce gallery access and consolidate gallery workflows (#1357)

Harden gallery authentication and authorization, consolidate gallery workflows, and prevent token-bearing URLs from leaking through nginx request error logs.

frontend/nginx.conf

@@ -1,3 +1,11 @@
+    # URLs and Referer can contain gallery, image and customer bearer tokens.
+    map $uri $request_surface {
+        ~*^/api/(?<picpeak_surface>[a-z-]+)(?:/|$) /api/$picpeak_surface;
+        default /;
+    }
+    log_format picpeak_safe '$remote_addr "$http_x_forwarded_for" [$time_local] "$request_method $request_surface" '
+                            '$status $body_bytes_sent $request_time';
+
 # Honour the outer reverse proxy's X-Forwarded-Proto when present (e.g. NPM,
 # Traefik, Caddy in front of PicPeak). Falls back to nginx's own $scheme when
 # the header is absent (direct access / no outer proxy). Without this the
@@ -10,6 +18,10 @@ map $http_x_forwarded_proto $real_proto {
 }
 
 server {
+    access_log /var/log/nginx/access.log picpeak_safe;
+    # Native request errors include bearer URLs even at crit/alert severity.
+    # Safe access logs retain status/timing; process diagnostics stay at main level.
+    error_log /dev/null;
     listen 80;
     server_name localhost;
     server_tokens off;