feat(photos): fix trash permanent delete and add empty trash

Permanently deleting a photo whose album was deleted failed because
authorization resolved through the album. Fall back to uploader
ownership when the photo is albumless. Add a bulk DELETE /trash that
removes every trashed photo the caller may delete (uncapped listing)
and returns the deleted count, with an «Очистить корзину» action on the
trash screen.

backend/internal/e2e/sqlite_test.go

@@ -39,11 +39,14 @@ func makePNG(t *testing.T) []byte {
 }
 
 type stack struct {
-	db     *sql.DB
-	photos *photos.Service
-	albums *albums.Service
-	auth   *auth.Service
-	hub    *sse.Hub
+	db      *sql.DB
+	photos  *photos.Service
+	albums  *albums.Service
+	auth    *auth.Service
+	hub     *sse.Hub
+	tm      *auth.TokenManager
+	repos   store.Repos
+	storage storage.Backend
 }
 
 // openStack opens a migrated SQLite database at path and builds the services.
@@ -70,10 +73,11 @@ func openStack(t *testing.T, path, blobRoot string) (*stack, func()) {
 	if err != nil {
 		t.Fatalf("fs: %v", err)
 	}
-	authSvc := auth.NewService(repos.Auth, auth.NewTokenManager("secret", 15*time.Minute, time.Hour))
+	tm := auth.NewTokenManager("secret", 15*time.Minute, time.Hour)
+	authSvc := auth.NewService(repos.Auth, tm)
 	albumsSvc := albums.NewService(repos.Albums, repos.Members, hub, blob)
 	photosSvc := photos.NewService(repos.Photos, albumsSvc, blob, hub)
-	return &stack{db: database, photos: photosSvc, albums: albumsSvc, auth: authSvc, hub: hub}, func() { database.Close() }
+	return &stack{db: database, photos: photosSvc, albums: albumsSvc, auth: authSvc, hub: hub, tm: tm, repos: repos, storage: blob}, func() { database.Close() }
 }
 
 func TestUploadSetsDefaultCover(t *testing.T) {