feat: implement shared-album multi-user photo album

Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client
(path-style, region garage), embedded golang-migrate migrations, JWT auth with
refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix,
photo upload + async imaging/goexif WebP variants, cursor pagination, presigned
URLs, likes/comments, SSE hub (album + personal), notifications, share links.

Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh,
auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with
reconnect + REST catch-up, three themes + system via data-theme.

Deploy without Docker: Makefile builds the frontend into backend/static and
embeds it (go:embed) into a single statically linked binary; systemd unit and
nginx SSE example included.

Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep
CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.

backend/cmd/migrate/main.go

@@ -0,0 +1,78 @@
+package main
+
+import (
+	"io/fs"
+	"log/slog"
+	"os"
+
+	assets "shared-album"
+	"shared-album/internal/config"
+	"shared-album/internal/db"
+)
+
+func main() {
+	loadDotEnv(".env")
+	loadDotEnv("../.env")
+
+	cfg, err := config.Load()
+	if err != nil {
+		slog.Error("config error", "error", err)
+		os.Exit(1)
+	}
+	migFS, err := fs.Sub(assets.Migrations, "migrations")
+	if err != nil {
+		slog.Error("migrations fs", "error", err)
+		os.Exit(1)
+	}
+	if err := db.Migrate(cfg.Postgres.DSN(), migFS); err != nil {
+		slog.Error("migration failed", "error", err)
+		os.Exit(1)
+	}
+	slog.Info("migrations applied")
+}
+
+func loadDotEnv(path string) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return
+	}
+	for _, line := range splitLines(string(data)) {
+		if line == "" || line[0] == '#' {
+			continue
+		}
+		for i := 0; i < len(line); i++ {
+			if line[i] == '=' {
+				key := line[:i]
+				val := line[i+1:]
+				if _, exists := os.LookupEnv(key); !exists {
+					_ = os.Setenv(key, val)
+				}
+				break
+			}
+		}
+	}
+}
+
+func splitLines(s string) []string {
+	var out []string
+	start := 0
+	for i := 0; i < len(s); i++ {
+		if s[i] == '\n' {
+			out = append(out, trim(s[start:i]))
+			start = i + 1
+		}
+	}
+	out = append(out, trim(s[start:]))
+	return out
+}
+
+func trim(s string) string {
+	start, end := 0, len(s)
+	for start < end && (s[start] == ' ' || s[start] == '\t' || s[start] == '\r') {
+		start++
+	}
+	for end > start && (s[end-1] == ' ' || s[end-1] == '\t' || s[end-1] == '\r') {
+		end--
+	}
+	return s[start:end]
+}

backend/cmd/server/main.go

@@ -0,0 +1,115 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"io/fs"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	assets "shared-album"
+	"shared-album/internal/app"
+	"shared-album/internal/config"
+	"shared-album/internal/db"
+	"shared-album/internal/sse"
+	"shared-album/internal/storage"
+)
+
+func main() {
+	loadDotEnv(".env")
+	loadDotEnv("../.env")
+
+	logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
+	slog.SetDefault(logger)
+
+	cfg, err := config.Load()
+	if err != nil {
+		slog.Error("config error", "error", err)
+		os.Exit(1)
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	migFS, err := fs.Sub(assets.Migrations, "migrations")
+	if err != nil {
+		slog.Error("migrations fs", "error", err)
+		os.Exit(1)
+	}
+	if err := db.Migrate(cfg.Postgres.DSN(), migFS); err != nil {
+		slog.Error("migration failed", "error", err)
+		os.Exit(1)
+	}
+	slog.Info("migrations applied")
+
+	pool, err := db.Connect(ctx, cfg.Postgres.DSN())
+	if err != nil {
+		slog.Error("database connect failed", "error", err)
+		os.Exit(1)
+	}
+	defer pool.Close()
+
+	store, err := storage.New(ctx, cfg.S3)
+	if err != nil {
+		slog.Error("storage init failed", "error", err)
+		os.Exit(1)
+	}
+	if err := store.EnsureBucket(ctx); err != nil {
+		slog.Warn("could not ensure bucket", "error", err)
+	} else {
+		slog.Info("storage bucket ready", "bucket", store.Bucket())
+	}
+
+	hub := sse.NewHub(cfg.SSE.ClientBuffer)
+	server := app.New(cfg, pool, store, hub)
+
+	httpServer := &http.Server{
+		Addr:              cfg.Server.Addr,
+		Handler:           server.Router(),
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+
+	go func() {
+		slog.Info("listening", "addr", cfg.Server.Addr)
+		if err := httpServer.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			slog.Error("server error", "error", err)
+			stop()
+		}
+	}()
+
+	<-ctx.Done()
+	slog.Info("shutting down")
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	_ = httpServer.Shutdown(shutdownCtx)
+}
+
+func loadDotEnv(path string) {
+	f, err := os.Open(path)
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		key, value, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		key = strings.TrimSpace(key)
+		value = strings.TrimSpace(value)
+		if _, exists := os.LookupEnv(key); !exists {
+			_ = os.Setenv(key, value)
+		}
+	}
+}