fix: harden gallery downloads and per-gallery auth

frontend/src/pages/admin/CreateEventPage.tsx

@@ -241,20 +241,22 @@ export const CreateEventPage: React.FC = () => {
 
     const selectedTheme = COLOR_THEMES.find(t => t.value === formData.color_theme);
     
-    createMutation.mutate({
+    const payload = {
       event_type: formData.event_type,
       event_name: formData.event_name,
       event_date: formData.event_date,
       host_email: formData.host_email,
       admin_email: formData.admin_email,
       require_password: formData.require_password,
-      password: formData.require_password ? formData.password : '',
+      password: formData.require_password ? formData.password : undefined,
       welcome_message: formData.welcome_message || '',
       color_theme: selectedTheme ? JSON.stringify(selectedTheme.theme) : undefined,
       expiration_days: formData.expires_in_days,
       allow_user_uploads: formData.allow_user_uploads,
       upload_category_id: formData.upload_category_id,
-    });
+    };
+
+    createMutation.mutate(payload);
   };
 
   const handleInputChange = (field: keyof FormData) => (
@@ -438,7 +440,12 @@ export const CreateEventPage: React.FC = () => {
                 checked={formData.require_password}
                 onChange={(e) => {
                   const checked = e.target.checked;
-                  setFormData(prev => ({ ...prev, require_password: checked }));
+                  setFormData(prev => ({
+                    ...prev,
+                    require_password: checked,
+                    password: checked ? prev.password : '',
+                    confirm_password: checked ? prev.confirm_password : ''
+                  }));
                   if (!checked) {
                     setErrors(prev => ({ ...prev, password: '', confirm_password: '' }));
                   }

frontend/src/pages/admin/CreateEventPageEnhanced.tsx

@@ -240,7 +240,7 @@ export const CreateEventPageEnhanced: React.FC = () => {
       host_email: formData.host_email,
       admin_email: formData.admin_email,
       require_password: formData.require_password,
-      password: formData.require_password ? formData.password : '',
+      password: formData.require_password ? formData.password : undefined,
       welcome_message: formData.welcome_message || '',
       color_theme: JSON.stringify(formData.theme_config),
       expiration_days: formData.expires_in_days,
@@ -511,6 +511,8 @@ export const CreateEventPageEnhanced: React.FC = () => {
                     setFormData(prev => ({
                       ...prev,
                       require_password: checked,
+                      password: checked ? prev.password : '',
+                      confirm_password: checked ? prev.confirm_password : '',
                     }));
                     if (!checked) {
                       setErrors(prev => ({ ...prev, password: undefined, confirm_password: undefined }));

frontend/src/services/events.service.ts

@@ -14,7 +14,7 @@ interface CreateEventData {
   host_email: string;
   admin_email: string;
   require_password?: boolean;
-  password: string;
+  password?: string;
   welcome_message?: string;
   color_theme?: string;
   expiration_days: number;

frontend/src/utils/cleanupGalleryAuth.ts

@@ -24,4 +24,19 @@ export const cleanupOldGalleryAuth = () => {
   sessionStorage.removeItem('gallery_event');
   sessionStorage.removeItem('gallery_token');
   sessionStorage.removeItem('gallery_active_slug');
+
+  // Remove slug-specific session storage entries as well
+  try {
+    const sessionKeysToRemove: string[] = [];
+    for (let i = 0; i < sessionStorage.length; i += 1) {
+      const key = sessionStorage.key(i);
+      if (key && (key.startsWith('gallery_event_') || key.startsWith('gallery_token_'))) {
+        sessionKeysToRemove.push(key);
+      }
+    }
+
+    sessionKeysToRemove.forEach((key) => sessionStorage.removeItem(key));
+  } catch {
+    // Session storage may be unavailable; ignore cleanup failures
+  }
 };