fix: enforce gallery access and consolidate gallery workflows (#1357)

Harden gallery authentication and authorization, consolidate gallery workflows, and prevent token-bearing URLs from leaking through nginx request error logs.

frontend/nginx.dev.conf

@@ -1,3 +1,11 @@
+    # URLs and Referer can contain gallery, image and customer bearer tokens.
+    map $uri $request_surface {
+        ~*^/api/(?<picpeak_surface>[a-z-]+)(?:/|$) /api/$picpeak_surface;
+        default /;
+    }
+    log_format picpeak_safe '$remote_addr "$http_x_forwarded_for" [$time_local] "$request_method $request_surface" '
+                            '$status $body_bytes_sent $request_time';
+
 # Honour outer reverse-proxy's X-Forwarded-Proto when present (see #547 /
 # frontend/nginx.conf for full rationale).
 map $http_x_forwarded_proto $real_proto {
@@ -6,6 +14,10 @@ map $http_x_forwarded_proto $real_proto {
 }
 
 server {
+    access_log /var/log/nginx/access.log picpeak_safe;
+    # Native request errors include bearer URLs even at crit/alert severity.
+    # Safe access logs retain status/timing; process diagnostics stay at main level.
+    error_log /dev/null;
     listen 80;
     server_name localhost;
     root /usr/share/nginx/html;
@@ -55,4 +67,4 @@ server {
     location / {
         try_files $uri $uri/ /index.html;
     }
-}
+}