fix: enforce gallery access and consolidate gallery workflows (#1357)

Harden gallery authentication and authorization, consolidate gallery workflows, and prevent token-bearing URLs from leaking through nginx request error logs.

nginx/nginx.conf

@@ -8,14 +8,20 @@ events {
 }
 
 http {
+    # Native request errors include bearer URLs even at crit/alert severity.
+    # Safe access logs retain status/timing; process diagnostics stay at main level.
+    error_log /dev/null;
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
-    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-                    '$status $body_bytes_sent "$http_referer" '
-                    '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log /var/log/nginx/access.log main;
+    # URLs and Referer can contain gallery, image and customer bearer tokens.
+    map $uri $request_surface {
+        ~*^/api/(?<picpeak_surface>[a-z-]+)(?:/|$) /api/$picpeak_surface;
+        default /;
+    }
+    log_format picpeak_safe '$remote_addr "$http_x_forwarded_for" [$time_local] "$request_method $request_surface" '
+                            '$status $body_bytes_sent $request_time';
+    access_log /var/log/nginx/access.log picpeak_safe;
 
     sendfile on;
     tcp_nopush on;