feat: lightroom-style workspace UI with album covers

Backend:
- expose cover thumbnail URL on album responses (LEFT JOIN + presign)
- auto-assign cover only when empty; FK cover_photo_id -> photos ON DELETE SET NULL
- add photos_count / members_count to album responses; cover repo test

Frontend:
- split layouts into (app) shell (resizable rail + contextual panel) and (public)
- album rail + create-album dialog; album panel with cover picker / make-cover
- photo viewer route with filmstrip, replacing lightbox; share reuses it
- grid density slider, toolbar + drag-and-drop upload, dark graphite default

OpenSpec: add lightroom-workspace-ui change (proposal, design, specs, tasks)

frontend/src/routes/(public)/+layout.svelte

@@ -0,0 +1,21 @@
+<script lang="ts">
+	import ThemeSwitcher from '$lib/components/ThemeSwitcher.svelte';
+	import Icon from '$lib/components/Icon.svelte';
+
+	let { children } = $props();
+</script>
+
+<div class="bg-canvas text-text min-h-screen">
+	<header class="border-border bg-chrome border-b">
+		<div class="mx-auto flex max-w-6xl items-center justify-between px-4 py-3">
+			<a href="/" class="inline-flex items-center gap-2 text-lg font-semibold">
+				<Icon name="photo_camera" />
+				Galo
+			</a>
+			<ThemeSwitcher />
+		</div>
+	</header>
+	<main class="mx-auto max-w-6xl px-4 py-6">
+		{@render children()}
+	</main>
+</div>

frontend/src/routes/(public)/invites/[token]/+page.svelte

@@ -0,0 +1,65 @@
+<script lang="ts">
+	import { page } from '$app/stores';
+	import { goto } from '$app/navigation';
+	import { api } from '$lib/api';
+	import Icon from '$lib/components/Icon.svelte';
+	import { auth } from '$lib/stores/auth.svelte';
+
+	const token = $derived($page.params.token);
+
+	let info = $state<{ album_id: string; role: string; expires_at: string } | null>(null);
+	let error = $state('');
+	let busy = $state(false);
+
+	$effect(() => {
+		api<{ invite: typeof info }>(`/invites/${token}`)
+			.then((data) => (info = data.invite))
+			.catch((e) => (error = (e as Error).message));
+	});
+
+	async function accept() {
+		busy = true;
+		error = '';
+		try {
+			const data = await api<{ album_id: string }>(`/invites/${token}/accept`, {
+				method: 'POST'
+			});
+			goto(`/albums/${data.album_id}`);
+		} catch (e) {
+			error = (e as Error).message;
+		} finally {
+			busy = false;
+		}
+	}
+</script>
+
+<div class="mx-auto max-w-md py-12 text-center">
+	<h1 class="mb-4 text-2xl font-bold">Приглашение в альбом</h1>
+	{#if error}
+		<p class="text-danger">{error}</p>
+	{:else if info}
+		<p class="text-text-muted mb-6">Вас приглашают с ролью <strong>{info.role}</strong>.</p>
+		{#if auth.isAuthenticated}
+			<button
+				type="button"
+				disabled={busy}
+				onclick={accept}
+				class="bg-primary text-primary-fg inline-flex items-center gap-2 rounded-lg px-5 py-2.5 font-medium"
+			>
+				<Icon name="check" class="size-5" />
+				{busy ? 'Принятие…' : 'Принять приглашение'}
+			</button>
+		{:else}
+			<p class="mb-4 text-sm">Войдите или зарегистрируйтесь, чтобы принять приглашение.</p>
+			<a
+				href="/login"
+				class="bg-primary text-primary-fg inline-flex items-center gap-2 rounded-lg px-5 py-2.5 font-medium"
+			>
+				<Icon name="login" class="size-5" />
+				Войти
+			</a>
+		{/if}
+	{:else}
+		<p class="text-text-muted">Загрузка…</p>
+	{/if}
+</div>

frontend/src/routes/(public)/login/+page.svelte

@@ -0,0 +1,85 @@
+<script lang="ts">
+	import { goto } from '$app/navigation';
+	import { authApi } from '$lib/api';
+	import { auth } from '$lib/stores/auth.svelte';
+
+	let mode = $state<'login' | 'register'>('login');
+	let email = $state('');
+	let password = $state('');
+	let name = $state('');
+	let error = $state('');
+	let busy = $state(false);
+
+	async function submit(ev: Event) {
+		ev.preventDefault();
+		error = '';
+		busy = true;
+		try {
+			const data =
+				mode === 'login'
+					? await authApi.login(email, password)
+					: await authApi.register(email, password, name);
+			auth.setTokens(data.tokens);
+			auth.setUser(data.user);
+			goto('/');
+		} catch (e) {
+			error = (e as Error).message;
+		} finally {
+			busy = false;
+		}
+	}
+</script>
+
+<div class="mx-auto max-w-sm py-10">
+	<h1 class="mb-6 text-2xl font-bold">{mode === 'login' ? 'Вход' : 'Регистрация'}</h1>
+
+	<form class="space-y-4" onsubmit={submit}>
+		{#if mode === 'register'}
+			<label class="block">
+				<span class="text-text-muted mb-1 block text-sm">Имя</span>
+				<input
+					bind:value={name}
+					required
+					class="border-border bg-bg-elevated text-text w-full rounded-lg border px-3 py-2"
+				/>
+			</label>
+		{/if}
+		<label class="block">
+			<span class="text-text-muted mb-1 block text-sm">Email</span>
+			<input
+				bind:value={email}
+				type="email"
+				required
+				class="border-border bg-bg-elevated text-text w-full rounded-lg border px-3 py-2"
+			/>
+		</label>
+		<label class="block">
+			<span class="text-text-muted mb-1 block text-sm">Пароль</span>
+			<input
+				bind:value={password}
+				type="password"
+				required
+				minlength="8"
+				class="border-border bg-bg-elevated text-text w-full rounded-lg border px-3 py-2"
+			/>
+		</label>
+
+		{#if error}<p class="text-danger text-sm">{error}</p>{/if}
+
+		<button
+			type="submit"
+			disabled={busy}
+			class="bg-primary text-primary-fg w-full rounded-lg px-4 py-2.5 font-medium disabled:opacity-50"
+		>
+			{busy ? 'Подождите…' : mode === 'login' ? 'Войти' : 'Зарегистрироваться'}
+		</button>
+	</form>
+
+	<button
+		type="button"
+		class="text-primary mt-4 text-sm"
+		onclick={() => (mode = mode === 'login' ? 'register' : 'login')}
+	>
+		{mode === 'login' ? 'Нет аккаунта? Зарегистрироваться' : 'Уже есть аккаунт? Войти'}
+	</button>
+</div>

frontend/src/routes/(public)/share/[token]/+page.svelte

@@ -0,0 +1,80 @@
+<script lang="ts">
+	import { page } from '$app/stores';
+	import { api } from '$lib/api';
+	import Icon from '$lib/components/Icon.svelte';
+	import PhotoGrid from '$lib/components/PhotoGrid.svelte';
+	import Viewer from '$lib/components/Viewer.svelte';
+	import type { Album, Photo } from '$lib/types';
+
+	const token = $derived($page.params.token);
+
+	let album = $state<Album | null>(null);
+	let photos = $state<Photo[]>([]);
+	let nextCursor = $state('');
+	let error = $state('');
+	let active = $state(-1);
+
+	async function load() {
+		try {
+			const [albumData, photosData] = await Promise.all([
+				api<{ album: Album }>(`/share/${token}`),
+				api<{ photos: Photo[]; next_cursor: string }>(`/share/${token}/photos`)
+			]);
+			album = albumData.album;
+			photos = photosData.photos;
+			nextCursor = photosData.next_cursor;
+		} catch (e) {
+			error = (e as Error).message;
+		}
+	}
+
+	async function loadMore() {
+		if (!nextCursor) return;
+		const data = await api<{ photos: Photo[]; next_cursor: string }>(
+			`/share/${token}/photos?cursor=${encodeURIComponent(nextCursor)}`
+		);
+		photos = [...photos, ...data.photos];
+		nextCursor = data.next_cursor;
+	}
+
+	$effect(() => {
+		token;
+		load();
+	});
+</script>
+
+{#if error}
+	<div class="py-16 text-center">
+		<h1 class="mb-2 text-2xl font-bold">Доступ недоступен</h1>
+		<p class="text-danger">{error}</p>
+	</div>
+{:else if album}
+	<h1 class="mb-2 text-2xl font-bold">{album.title}</h1>
+	<p class="text-text-muted mb-6">Доступ только для просмотра · {album.description}</p>
+	<PhotoGrid {photos} onOpen={(i) => (active = i)} />
+	{#if nextCursor}
+		<div class="mt-6 text-center">
+			<button
+				type="button"
+				class="border-border text-text inline-flex items-center gap-1.5 rounded-lg border px-4 py-2 text-sm"
+				onclick={loadMore}
+			>
+				<Icon name="expand_more" class="size-4" />
+				Показать ещё
+			</button>
+		</div>
+	{/if}
+
+	{#if active >= 0}
+		<div class="bg-canvas fixed inset-0 z-50" role="dialog" aria-modal="true" aria-label="Просмотр">
+			<Viewer
+				{photos}
+				index={active}
+				onClose={() => (active = -1)}
+				onIndexChange={(i) => (active = i)}
+			/>
+		</div>
+	{/if}
+{:else}
+	<p class="text-text-muted">Загрузка…</p>
+{/if}