feat(photos): fix trash permanent delete and add empty trash

Permanently deleting a photo whose album was deleted failed because
authorization resolved through the album. Fall back to uploader
ownership when the photo is albumless. Add a bulk DELETE /trash that
removes every trashed photo the caller may delete (uncapped listing)
and returns the deleted count, with an «Очистить корзину» action on the
trash screen.

backend/internal/photos/service.go

@@ -597,12 +597,19 @@ func (s *Service) PermanentDelete(ctx context.Context, photoID, userID string) e
 		}
 		return err
 	}
-	_, role, err := s.albums.Access(ctx, p.AlbumID, userID)
-	if err != nil {
-		return err
-	}
-	if !canDeletePhoto(role, p.UploaderID == userID) {
-		return httpx.Forbidden("forbidden", "you cannot delete this photo")
+	if p.AlbumID == "" {
+		// A photo whose album was deleted only has its uploader to vouch for it.
+		if p.UploaderID != userID {
+			return httpx.Forbidden("forbidden", "you cannot delete this photo")
+		}
+	} else {
+		_, role, err := s.albums.Access(ctx, p.AlbumID, userID)
+		if err != nil {
+			return err
+		}
+		if !canDeletePhoto(role, p.UploaderID == userID) {
+			return httpx.Forbidden("forbidden", "you cannot delete this photo")
+		}
 	}
 	objectIDs, err := s.store.PhotoObjectIDs(ctx, photoID)
 	if err != nil {
@@ -624,6 +631,23 @@ func (s *Service) PermanentDelete(ctx context.Context, photoID, userID string) e
 	return nil
 }
 
+// EmptyTrash permanently deletes every trashed photo the user may remove,
+// skipping the rest, and returns how many were deleted.
+func (s *Service) EmptyTrash(ctx context.Context, userID string) (int, error) {
+	items, err := s.store.ListTrashIdentities(ctx, userID)
+	if err != nil {
+		return 0, err
+	}
+	deleted := 0
+	for _, it := range items {
+		if err := s.PermanentDelete(ctx, it.ID, userID); err != nil {
+			continue
+		}
+		deleted++
+	}
+	return deleted, nil
+}
+
 // MoveBatch moves photos to another album (metadata only; stored objects untouched).
 func (s *Service) MoveBatch(ctx context.Context, ids []string, userID, targetAlbumID string) (int, error) {
 	_, targetRole, err := s.albums.Access(ctx, targetAlbumID, userID)