feat: implement shared-album multi-user photo album

Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client
(path-style, region garage), embedded golang-migrate migrations, JWT auth with
refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix,
photo upload + async imaging/goexif WebP variants, cursor pagination, presigned
URLs, likes/comments, SSE hub (album + personal), notifications, share links.

Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh,
auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with
reconnect + REST catch-up, three themes + system via data-theme.

Deploy without Docker: Makefile builds the frontend into backend/static and
embeds it (go:embed) into a single statically linked binary; systemd unit and
nginx SSE example included.

Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep
CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.

frontend/src/lib/api.ts

@@ -0,0 +1,101 @@
+import { goto } from '$app/navigation';
+import { auth, type Tokens, type User } from './stores/auth.svelte';
+
+export class ApiError extends Error {
+	status: number;
+	code: string;
+	constructor(status: number, code: string, message: string) {
+		super(message);
+		this.status = status;
+		this.code = code;
+	}
+}
+
+interface RequestOptions {
+	method?: string;
+	body?: unknown;
+	form?: FormData;
+}
+
+let refreshing: Promise<boolean> | null = null;
+
+async function raw(path: string, opts: RequestOptions): Promise<Response> {
+	const headers = new Headers();
+	if (auth.access) headers.set('Authorization', `Bearer ${auth.access}`);
+	let body: BodyInit | undefined;
+	if (opts.form) {
+		body = opts.form;
+	} else if (opts.body !== undefined) {
+		headers.set('Content-Type', 'application/json');
+		body = JSON.stringify(opts.body);
+	}
+	return fetch(`/api${path}`, { method: opts.method ?? 'GET', headers, body });
+}
+
+async function doRefresh(): Promise<boolean> {
+	if (!auth.refresh) return false;
+	try {
+		const res = await fetch('/api/auth/refresh', {
+			method: 'POST',
+			headers: { 'Content-Type': 'application/json' },
+			body: JSON.stringify({ refresh_token: auth.refresh })
+		});
+		if (!res.ok) return false;
+		const data = await res.json();
+		auth.setTokens(data.tokens as Tokens);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+export async function api<T = unknown>(path: string, opts: RequestOptions = {}): Promise<T> {
+	let res = await raw(path, opts);
+	if (res.status === 401 && auth.refresh) {
+		if (!refreshing) {
+			refreshing = doRefresh().finally(() => {
+				refreshing = null;
+			});
+		}
+		const ok = await refreshing;
+		if (ok) res = await raw(path, opts);
+	}
+	if (!res.ok) {
+		let code = 'error';
+		let message = res.statusText;
+		try {
+			const body = await res.json();
+			if (body?.error) {
+				code = body.error.code ?? code;
+				message = body.error.message ?? message;
+			}
+		} catch {
+			/* ignore */
+		}
+		if (res.status === 401) {
+			auth.clear();
+			goto('/login');
+		}
+		throw new ApiError(res.status, code, message);
+	}
+	if (res.status === 204) return null as T;
+	const ct = res.headers.get('content-type') ?? '';
+	if (ct.includes('application/json')) return (await res.json()) as T;
+	return (await res.text()) as unknown as T;
+}
+
+export const authApi = {
+	register: (email: string, password: string, name: string) =>
+		api<{ user: User; tokens: Tokens }>('/auth/register', {
+			method: 'POST',
+			body: { email, password, name }
+		}),
+	login: (email: string, password: string) =>
+		api<{ user: User; tokens: Tokens }>('/auth/login', {
+			method: 'POST',
+			body: { email, password }
+		}),
+	logout: (refresh_token: string) =>
+		api('/auth/logout', { method: 'POST', body: { refresh_token } }),
+	me: () => api<{ user: User }>('/auth/me')
+};