feat: rename service to galo, add halo branding and release build

- rename Go module, binary, systemd unit, PG_DATABASE default, frontend package and docs from shared-album to galo
- add theme-aware halo emblem and favicon (new ui-branding capability)
- add make build-release (versioned, stripped, static binary) and run the binary from the repo root

Makefile

@@ -1,4 +1,7 @@
-.PHONY: build frontend backend run migrate reconcile reconcile-delete tidy test clean
+.PHONY: build build-release frontend backend run migrate reconcile reconcile-delete tidy test clean
+
+# Release version stamped into the binary (-X main.version). Override with VERSION=...
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 
 frontend:
 	cd frontend && npm ci && npm run build
@@ -10,12 +13,27 @@ backend:
 	# -tags nodynamic forces gen2brain/webp to use its pure-Go transpiled path
 	# (no purego/dlopen), keeping the binary fully static.
 	cd backend && CGO_ENABLED=0 go build -tags nodynamic -trimpath -ldflags="-s -w" \
-		-o ../bin/shared-album ./cmd/server
+		-o ../bin/galo ./cmd/server
 
 build: frontend backend
 
+# Release build: full static, stripped and (if available) UPX-compressed binary
+# with the version embedded. Produces bin/galo and a copy at bin/galo-$(VERSION).
+build-release: frontend
+	mkdir -p bin
+	cd backend && CGO_ENABLED=0 go build -tags nodynamic -trimpath \
+		-ldflags="-s -w -X main.version=$(VERSION)" -o ../bin/galo ./cmd/server
+	strip --strip-all bin/galo
+	@if command -v upx >/dev/null 2>&1; then \
+		upx --best --quiet bin/galo && echo "upx: bin/galo compressed"; \
+	else \
+		echo "upx not found - skipping compression (install upx-ucl to enable)"; \
+	fi
+	cp bin/galo bin/galo-$(VERSION)
+	@echo "release: bin/galo-$(VERSION)"
+
 run: backend
-	cd backend && ../bin/shared-album
+	./bin/galo
 
 migrate:
 	cd backend && go run ./cmd/migrate