feat: implement shared-album multi-user photo album

Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client
(path-style, region garage), embedded golang-migrate migrations, JWT auth with
refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix,
photo upload + async imaging/goexif WebP variants, cursor pagination, presigned
URLs, likes/comments, SSE hub (album + personal), notifications, share links.

Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh,
auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with
reconnect + REST catch-up, three themes + system via data-theme.

Deploy without Docker: Makefile builds the frontend into backend/static and
embeds it (go:embed) into a single statically linked binary; systemd unit and
nginx SSE example included.

Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep
CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.

backend/internal/notifications/handlers.go

@@ -0,0 +1,35 @@
+package notifications
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"shared-album/internal/auth"
+	"shared-album/internal/httpx"
+)
+
+type Handler struct {
+	svc *Service
+}
+
+func NewHandler(svc *Service) *Handler { return &Handler{svc: svc} }
+
+func (h *Handler) List(c *gin.Context) {
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "100"))
+	list, err := h.svc.List(c.Request.Context(), auth.UserID(c), limit)
+	if err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"notifications": list})
+}
+
+func (h *Handler) MarkRead(c *gin.Context) {
+	if err := h.svc.MarkRead(c.Request.Context(), c.Param("id"), auth.UserID(c)); err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}

backend/internal/notifications/service.go

@@ -0,0 +1,44 @@
+package notifications
+
+import (
+	"context"
+
+	"shared-album/internal/auth"
+	"shared-album/internal/httpx"
+	"shared-album/internal/models"
+	"shared-album/internal/sse"
+)
+
+type Service struct {
+	store *Store
+	hub   *sse.Hub
+}
+
+func NewService(store *Store, hub *sse.Hub) *Service {
+	return &Service{store: store, hub: hub}
+}
+
+func (s *Service) Create(ctx context.Context, userID, typ string, payload map[string]any) error {
+	n := &models.Notification{
+		ID:          auth.NewID(),
+		UserID:      userID,
+		Type:        typ,
+		PayloadJSON: payload,
+	}
+	if err := s.store.Create(ctx, n); err != nil {
+		return err
+	}
+	s.hub.PublishUser(userID, "notification", n)
+	return nil
+}
+
+func (s *Service) List(ctx context.Context, userID string, limit int) ([]models.Notification, error) {
+	return s.store.List(ctx, userID, limit)
+}
+
+func (s *Service) MarkRead(ctx context.Context, id, userID string) error {
+	if err := s.store.MarkRead(ctx, id, userID); err != nil {
+		return httpx.NotFound("notification_not_found", "notification not found")
+	}
+	return nil
+}

backend/internal/notifications/store.go

@@ -0,0 +1,80 @@
+package notifications
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"shared-album/internal/models"
+)
+
+var ErrNotFound = errors.New("not found")
+
+type Store struct {
+	pool *pgxpool.Pool
+}
+
+func NewStore(pool *pgxpool.Pool) *Store { return &Store{pool: pool} }
+
+func (s *Store) Create(ctx context.Context, n *models.Notification) error {
+	payload, err := json.Marshal(n.PayloadJSON)
+	if err != nil {
+		return err
+	}
+	return s.pool.QueryRow(ctx,
+		`INSERT INTO notifications (id, user_id, type, payload_json)
+		 VALUES ($1, $2, $3, $4)
+		 RETURNING created_at`,
+		n.ID, n.UserID, n.Type, payload,
+	).Scan(&n.CreatedAt)
+}
+
+func (s *Store) List(ctx context.Context, userID string, limit int) ([]models.Notification, error) {
+	if limit <= 0 || limit > 200 {
+		limit = 100
+	}
+	rows, err := s.pool.Query(ctx,
+		`SELECT id, user_id, type, payload_json, read_at, created_at
+		 FROM notifications
+		 WHERE user_id = $1
+		 ORDER BY created_at DESC
+		 LIMIT $2`, userID, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := []models.Notification{}
+	for rows.Next() {
+		var n models.Notification
+		var payload []byte
+		if err := rows.Scan(&n.ID, &n.UserID, &n.Type, &payload, &n.ReadAt, &n.CreatedAt); err != nil {
+			return nil, err
+		}
+		_ = json.Unmarshal(payload, &n.PayloadJSON)
+		out = append(out, n)
+	}
+	return out, rows.Err()
+}
+
+func (s *Store) MarkRead(ctx context.Context, id, userID string) error {
+	tag, err := s.pool.Exec(ctx,
+		`UPDATE notifications SET read_at = now() WHERE id = $1 AND user_id = $2 AND read_at IS NULL`,
+		id, userID)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		var exists bool
+		if err := s.pool.QueryRow(ctx, `SELECT true FROM notifications WHERE id = $1 AND user_id = $2`, id, userID).Scan(&exists); err != nil {
+			if errors.Is(err, pgx.ErrNoRows) {
+				return ErrNotFound
+			}
+			return err
+		}
+	}
+	return nil
+}