feat: implement shared-album multi-user photo album

Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client
(path-style, region garage), embedded golang-migrate migrations, JWT auth with
refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix,
photo upload + async imaging/goexif WebP variants, cursor pagination, presigned
URLs, likes/comments, SSE hub (album + personal), notifications, share links.

Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh,
auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with
reconnect + REST catch-up, three themes + system via data-theme.

Deploy without Docker: Makefile builds the frontend into backend/static and
embeds it (go:embed) into a single statically linked binary; systemd unit and
nginx SSE example included.

Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep
CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.

deploy/nginx-sse.conf

@@ -0,0 +1,32 @@
+# Пример nginx-конфигурации перед Go-бэкендом.
+# Для SSE критично proxy_buffering off, иначе события буферизуются и не доходят.
+
+upstream shared_album {
+    server 127.0.0.1:8080;
+}
+
+server {
+    listen 80;
+    server_name album.example.com;
+
+    client_max_body_size 60m;
+
+    location /api/sse/ {
+        proxy_pass http://shared_album;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        proxy_buffering off;              # иначе SSE буферизуется
+        proxy_cache off;
+        proxy_read_timeout 1h;
+        chunked_transfer_encoding on;
+    }
+
+    location / {
+        proxy_pass http://shared_album;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

deploy/shared-album.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=Shared Album backend
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=album
+Group=album
+WorkingDirectory=/opt/shared-album
+EnvironmentFile=/opt/shared-album/.env
+ExecStart=/opt/shared-album/shared-album
+Restart=on-failure
+RestartSec=5s
+
+# Безопасность
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/shared-album
+
+[Install]
+WantedBy=multi-user.target