feat: implement shared-album multi-user photo album

Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client
(path-style, region garage), embedded golang-migrate migrations, JWT auth with
refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix,
photo upload + async imaging/goexif WebP variants, cursor pagination, presigned
URLs, likes/comments, SSE hub (album + personal), notifications, share links.

Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh,
auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with
reconnect + REST catch-up, three themes + system via data-theme.

Deploy without Docker: Makefile builds the frontend into backend/static and
embeds it (go:embed) into a single statically linked binary; systemd unit and
nginx SSE example included.

Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep
CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.

backend/internal/roles/roles.go

@@ -0,0 +1,98 @@
+package roles
+
+const (
+	Owner  = "owner"
+	Admin  = "admin"
+	Editor = "editor"
+	Member = "member"
+	Viewer = "viewer"
+)
+
+var rank = map[string]int{
+	Viewer: 0,
+	Member: 1,
+	Editor: 2,
+	Admin:  3,
+	Owner:  4,
+}
+
+func Rank(r string) int { return rank[r] }
+
+func ValidMemberRole(r string) bool {
+	switch r {
+	case Admin, Editor, Member, Viewer:
+		return true
+	}
+	return false
+}
+
+func CanUpload(r string) bool {
+	switch r {
+	case Owner, Admin, Editor, Member:
+		return true
+	}
+	return false
+}
+
+func CanComment(r string) bool {
+	return CanUpload(r)
+}
+
+func CanDeleteAnyPhoto(r string) bool {
+	return r == Owner || r == Admin
+}
+
+func CanDeleteOwnPhoto(r string) bool {
+	return CanUpload(r)
+}
+
+func CanEditAlbum(r string) bool {
+	return r == Owner || r == Admin
+}
+
+func CanManageShares(r string) bool {
+	return r == Owner || r == Admin
+}
+
+func CanInvite(actorRole, targetRole string) bool {
+	if actorRole == Editor {
+		return targetRole == Member || targetRole == Viewer
+	}
+	if actorRole != Owner && actorRole != Admin {
+		return false
+	}
+	if targetRole == Owner {
+		return false
+	}
+	return Rank(targetRole) <= Rank(actorRole)
+}
+
+func CanChangeRole(actorRole, targetCurrent, newRole string) bool {
+	if targetCurrent == Owner || newRole == Owner {
+		return false
+	}
+	if !ValidMemberRole(newRole) {
+		return false
+	}
+	switch actorRole {
+	case Owner:
+		return true
+	case Admin:
+		if targetCurrent == Admin {
+			return false
+		}
+		return newRole == Editor || newRole == Member || newRole == Viewer
+	default:
+		return false
+	}
+}
+
+func CanRemoveMember(actorRole, targetRole string) bool {
+	if actorRole != Owner && actorRole != Admin {
+		return false
+	}
+	if targetRole == Owner || targetRole == Admin {
+		return false
+	}
+	return true
+}