security: fix pre-auth bypasses and restore Immich 3.x compatibility (#378)

Seven security issues from an audit, plus album pages and the map coming
up empty against Immich 3.x. Verified against a real Immich 3.0.3
instance in a production build.

Security:
- Admin session forgery via a hardcoded 'dev-fallback-secret' signing key
  that bypassed the production AUTH_SECRET guard
- /api/map ignored album passwords and returned working asset tokens;
  rewriting ?size=thumbnail to ?size=original downloaded full-resolution
  originals from protected albums
- Admin login had no rate limit, and the client IP came from a spoofable
  header, so rotating it bypassed every limit in the app
- Raw Immich asset UUIDs were serialized into the RSC payload
- Album tokens never expired server-side; a captured token replayed forever
- Path traversal into the Immich API via an unvalidated album id
- /admin ran with no enforced CSP (only Report-Only reached it)

TRUSTED_PROXIES is replaced by TRUSTED_PROXY_HOPS. The old variable
matched proxy IPs against the socket peer address, which self-hosted
Next.js never exposes, so the check could never pass: unset, the limiter
read a spoofable header; set, every request shared one bucket and a single
client could rate-limit the whole site. Migrates automatically.

Immich 3.x: GET /albums/:id no longer embeds assets. Assets now come from
POST /search/metadata with withExif: true — without that flag EXIF is
omitted and grid aspect ratios, the lightbox panel and map markers stay
empty. Drops support for Immich below 3.0, which now logs a warning.

Upgrade: requires Immich 3.0+; set TRUSTED_PROXY_HOPS (nginx = 1);
visitors of protected areas and admin sessions must log in once more.

91 unit tests (25 new); the new admin-auth and rate-limit cases were
confirmed to fail against the pre-fix code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/__tests__/auth.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi } from 'vitest';
+import { describe, it, expect, vi, afterEach } from 'vitest';
 
 // Mock config to provide a predictable API key and subpage config
 vi.mock('@/lib/config', () => ({
@@ -93,3 +93,60 @@ describe('isAuthenticated', () => {
     expect(isAuthenticated('public', getCookie)).toBe(true);
   });
 });
+
+describe('token expiry', () => {
+  function tokenFor(slug: string, password: string): string {
+    return authenticate(slug, password)!.split('=')[1].split(';')[0];
+  }
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('rejects a token once its embedded expiry has passed', () => {
+    const token = tokenFor('private', 'secret123');
+    const getCookie = (name: string) => (name === 'lb_auth_private' ? token : undefined);
+    expect(isAuthenticated('private', getCookie)).toBe(true);
+
+    // Previously the 24h lifetime lived only in the cookie's Max-Age, so a
+    // captured token replayed via curl worked forever.
+    vi.useFakeTimers();
+    vi.setSystemTime(Date.now() + 25 * 60 * 60 * 1000);
+    expect(isAuthenticated('private', getCookie)).toBe(false);
+  });
+
+  it('still accepts a token just before it expires', () => {
+    const token = tokenFor('private', 'secret123');
+    const getCookie = (name: string) => (name === 'lb_auth_private' ? token : undefined);
+
+    vi.useFakeTimers();
+    vi.setSystemTime(Date.now() + 23 * 60 * 60 * 1000);
+    expect(isAuthenticated('private', getCookie)).toBe(true);
+  });
+
+  it('rejects a token whose expiry was tampered with', () => {
+    const token = tokenFor('private', 'secret123');
+    const [, sig] = token.split('.');
+    const farFuture = Date.now() + 365 * 24 * 60 * 60 * 1000;
+
+    // The expiry is covered by the HMAC, so extending it invalidates the token.
+    const getCookie = (name: string) =>
+      name === 'lb_auth_private' ? `${farFuture}.${sig}` : undefined;
+    expect(isAuthenticated('private', getCookie)).toBe(false);
+  });
+
+  it('rejects malformed and legacy tokens without throwing', () => {
+    for (const value of ['', '.', 'abc', 'abc.def', `${Date.now() + 1000}.`, 'deadbeef']) {
+      const getCookie = (name: string) => (name === 'lb_auth_private' ? value : undefined);
+      expect(() => isAuthenticated('private', getCookie)).not.toThrow();
+      expect(isAuthenticated('private', getCookie)).toBe(false);
+    }
+  });
+
+  it('sets a cookie Max-Age consistent with the embedded expiry', () => {
+    const cookie = authenticate('private', 'secret123')!;
+    const maxAge = Number(cookie.match(/Max-Age=(\d+)/)![1]);
+    const exp = Number(cookie.split('=')[1].split(';')[0].split('.')[0]);
+    expect(Math.abs(exp - (Date.now() + maxAge * 1000))).toBeLessThan(2000);
+  });
+});