feat: implement shared-album multi-user photo album

Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client
(path-style, region garage), embedded golang-migrate migrations, JWT auth with
refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix,
photo upload + async imaging/goexif WebP variants, cursor pagination, presigned
URLs, likes/comments, SSE hub (album + personal), notifications, share links.

Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh,
auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with
reconnect + REST catch-up, three themes + system via data-theme.

Deploy without Docker: Makefile builds the frontend into backend/static and
embeds it (go:embed) into a single statically linked binary; systemd unit and
nginx SSE example included.

Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep
CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.

backend/internal/httpx/httpx.go

@@ -0,0 +1,71 @@
+package httpx
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+type ErrorBody struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+type ErrorResponse struct {
+	Error ErrorBody `json:"error"`
+}
+
+type AppError struct {
+	Status  int
+	Code    string
+	Message string
+}
+
+func (e *AppError) Error() string { return e.Message }
+
+func NewError(status int, code, message string) *AppError {
+	return &AppError{Status: status, Code: code, Message: message}
+}
+
+func BadRequest(code, message string) *AppError {
+	return NewError(http.StatusBadRequest, code, message)
+}
+
+func Unauthorized(code, message string) *AppError {
+	return NewError(http.StatusUnauthorized, code, message)
+}
+
+func Forbidden(code, message string) *AppError {
+	return NewError(http.StatusForbidden, code, message)
+}
+
+func NotFound(code, message string) *AppError {
+	return NewError(http.StatusNotFound, code, message)
+}
+
+func Conflict(code, message string) *AppError {
+	return NewError(http.StatusConflict, code, message)
+}
+
+func Internal(message string) *AppError {
+	return NewError(http.StatusInternalServerError, "internal_error", message)
+}
+
+func Abort(c *gin.Context, err error) {
+	var appErr *AppError
+	if errors.As(err, &appErr) {
+		c.AbortWithStatusJSON(appErr.Status, ErrorResponse{ErrorBody{appErr.Code, appErr.Message}})
+		return
+	}
+	c.AbortWithStatusJSON(http.StatusInternalServerError, ErrorResponse{ErrorBody{"internal_error", "internal server error"}})
+}
+
+func RespondError(c *gin.Context, err error) {
+	var appErr *AppError
+	if errors.As(err, &appErr) {
+		c.JSON(appErr.Status, ErrorResponse{ErrorBody{appErr.Code, appErr.Message}})
+		return
+	}
+	c.JSON(http.StatusInternalServerError, ErrorResponse{ErrorBody{"internal_error", "internal server error"}})
+}