feat: implement shared-album multi-user photo album

Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client
(path-style, region garage), embedded golang-migrate migrations, JWT auth with
refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix,
photo upload + async imaging/goexif WebP variants, cursor pagination, presigned
URLs, likes/comments, SSE hub (album + personal), notifications, share links.

Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh,
auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with
reconnect + REST catch-up, three themes + system via data-theme.

Deploy without Docker: Makefile builds the frontend into backend/static and
embeds it (go:embed) into a single statically linked binary; systemd unit and
nginx SSE example included.

Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep
CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.

frontend/src/routes/invites/[token]/+page.svelte

@@ -0,0 +1,57 @@
+<script lang="ts">
+	import { page } from '$app/stores';
+	import { goto } from '$app/navigation';
+	import { api } from '$lib/api';
+	import { auth } from '$lib/stores/auth.svelte';
+
+	const token = $derived($page.params.token);
+
+	let info = $state<{ album_id: string; role: string; expires_at: string } | null>(null);
+	let error = $state('');
+	let busy = $state(false);
+
+	$effect(() => {
+		api<{ invite: typeof info }>(`/invites/${token}`)
+			.then((data) => (info = data.invite))
+			.catch((e) => (error = (e as Error).message));
+	});
+
+	async function accept() {
+		busy = true;
+		error = '';
+		try {
+			const data = await api<{ album_id: string }>(`/invites/${token}/accept`, {
+				method: 'POST'
+			});
+			goto(`/albums/${data.album_id}`);
+		} catch (e) {
+			error = (e as Error).message;
+		} finally {
+			busy = false;
+		}
+	}
+</script>
+
+<div class="mx-auto max-w-md py-12 text-center">
+	<h1 class="mb-4 text-2xl font-bold">Приглашение в альбом</h1>
+	{#if error}
+		<p class="text-danger">{error}</p>
+	{:else if info}
+		<p class="text-text-muted mb-6">Вас приглашают с ролью <strong>{info.role}</strong>.</p>
+		{#if auth.isAuthenticated}
+			<button
+				type="button"
+				disabled={busy}
+				onclick={accept}
+				class="bg-primary text-primary-fg rounded-lg px-5 py-2.5 font-medium"
+			>
+				{busy ? 'Принятие…' : 'Принять приглашение'}
+			</button>
+		{:else}
+			<p class="mb-4 text-sm">Войдите или зарегистрируйтесь, чтобы принять приглашение.</p>
+			<a href="/login" class="bg-primary text-primary-fg rounded-lg px-5 py-2.5 font-medium">Войти</a>
+		{/if}
+	{:else}
+		<p class="text-text-muted">Загрузка…</p>
+	{/if}
+</div>