feat: implement shared-album multi-user photo album

Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client
(path-style, region garage), embedded golang-migrate migrations, JWT auth with
refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix,
photo upload + async imaging/goexif WebP variants, cursor pagination, presigned
URLs, likes/comments, SSE hub (album + personal), notifications, share links.

Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh,
auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with
reconnect + REST catch-up, three themes + system via data-theme.

Deploy without Docker: Makefile builds the frontend into backend/static and
embeds it (go:embed) into a single statically linked binary; systemd unit and
nginx SSE example included.

Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep
CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.

backend/internal/auth/middleware.go

@@ -0,0 +1,61 @@
+package auth
+
+import (
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"shared-album/internal/httpx"
+)
+
+const (
+	ctxUserID = "auth.user_id"
+	ctxEmail  = "auth.email"
+)
+
+func (s *Service) Middleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := extractToken(c)
+		if token == "" {
+			httpx.Abort(c, httpx.Unauthorized("unauthorized", "missing access token"))
+			return
+		}
+		claims, err := s.tm.ParseAccess(token)
+		if err != nil {
+			httpx.Abort(c, httpx.Unauthorized("unauthorized", "invalid or expired access token"))
+			return
+		}
+		c.Set(ctxUserID, claims.UserID)
+		c.Set(ctxEmail, claims.Email)
+		c.Next()
+	}
+}
+
+func extractToken(c *gin.Context) string {
+	h := c.GetHeader("Authorization")
+	if strings.HasPrefix(h, "Bearer ") {
+		return strings.TrimPrefix(h, "Bearer ")
+	}
+	if t := c.Query("token"); t != "" {
+		return t
+	}
+	return ""
+}
+
+func UserID(c *gin.Context) string {
+	if v, ok := c.Get(ctxUserID); ok {
+		return v.(string)
+	}
+	return ""
+}
+
+func Email(c *gin.Context) string {
+	if v, ok := c.Get(ctxEmail); ok {
+		return v.(string)
+	}
+	return ""
+}
+
+func (s *Service) ParseToken(token string) (*Claims, error) {
+	return s.tm.ParseAccess(token)
+}