chore: add CSP headers, fix mobile hero, clean up plans

- Add Content-Security-Policy + security headers to next.config.ts
- Fix hero image cutoff on mobile iOS (40vh → 50svh)
- Mark all plan checklists as complete
- Clean up IDEAS.md: remove implemented items, add ✅ table
- Add photo stories implementation plan draft

plans/IDEAS.md

@@ -4,10 +4,7 @@
 
 - **Internationalization (i18n)** — Multi-language UI support (DE/EN). Extend YAML config with locale files
 - **ISR / Stale-While-Revalidate** — Replace `force-dynamic` with Incremental Static Regeneration + on-demand revalidation
-- **Image CDN / Edge caching** — Add `Cache-Control` headers on `/api/image` proxy responses to reduce Immich load
-- **Structured logging** — Replace console.log with `pino` for production observability (request IDs, timings, cache hits)
-- **CI/CD pipeline** — GitHub Actions: lint → typecheck → unit tests → Playwright E2E → Docker build → push to GHCR
-- **Content Security Policy** — CSP headers to lock down the public-facing site
+- **CI/CD pipeline** — GitHub Actions: lint → typecheck → unit tests → Playwright E2E → Docker build → push to GHCR _(Playwright tests exist, needs GH Actions workflow)_
 - **Privacy-friendly analytics** — Plausible or Umami (self-hosted) to track album/photo engagement
 
 ## 📸 Photographer
@@ -15,18 +12,15 @@
 - **Photo stories / Essays** — Vertical scroll format with images + text interspersed, like a photo essay. Portfolio differentiator
 - **Map view** — Minimal world map from EXIF city/country data, each dot links to an album. Mapbox GL or Leaflet
 - **Monochrome / Film simulation toggle** — CSS filters for grayscale, Tri-X, Portra 400 looks across the grid
-- **Before/After slider** — Draggable comparison slider in lightbox for edit showcases
 - **Collections by camera/lens** — Auto-generate virtual albums from EXIF data ("Shot on Leica Q3", "Summilux 35mm")
-- **Photo of the day / Favorites** — Rotate a featured hero photo, driven by tag in Immich or `gallery.yaml`
 
 ## 👤 User / Visitor
 
 - **Slideshow mode** — Auto-advance through photos (3s/5s/10s). Great for exhibitions and ambient display
-- **Photo sharing** — "Copy link" button in lightbox with toast + per-photo OG image generation
+- **Photo sharing** — "Copy link" button in lightbox with toast notification
 - **Keyboard shortcut hints** — `?` button revealing available shortcuts (arrows, Esc, F for fullscreen)
 - **Fullscreen API** — Chrome-free immersive viewing in lightbox
 - **Pinch-to-zoom** — Touch gesture zoom in lightbox for detail viewing
-- **Album / Subpage descriptions** — Markdown description per subpage in `gallery.yaml`, shown above the grid
 - **Progressive loading animation** — Ken Burns zoom/pan on ThumbHash placeholders while loading
 
 ## 🏆 Quick Wins (High Impact / Low Effort)
@@ -34,10 +28,31 @@
 | Idea | Effort | Impact |
 |------|--------|--------|
 | Slideshow mode | Low | High — exhibition ready |
-| Copy link + per-photo OG | Low | High — shareability |
-| Album descriptions in YAML | Low | Medium — context |
 | Fullscreen API in lightbox | Low | Medium — immersive |
 | Monochrome toggle | Low | Medium — Leica vibes |
 | ISR caching | Medium | High — performance |
 | Photo stories/essays | High | Very high — differentiator |
 | Map view | Medium | High — wow factor |
+
+## ✅ Already Implemented
+
+| Feature | Notes |
+|---------|-------|
+| Image CDN / Edge caching | `Cache-Control: immutable` on `/api/image` proxy |
+| OG image generation | Dynamic OG images via `/api/og` |
+| Hero image carousel | Crossfade carousel from `gallery.yaml` hero images |
+| EXIF metadata display | Print-style captions on photo grid hover |
+| Per-album password protection | Cookie-based auth gate per subpage |
+| Asset ID obfuscation | AES-encrypted tokens in public URLs |
+| Rate limiting | On image proxy endpoint |
+| YAML-based config | `gallery.yaml` replaces env-var config |
+| Playwright E2E tests | Basic test suite in `e2e/` |
+| Fade-in animations | Intersection Observer based |
+| Theme toggle (dark/light) | Persisted via cookie |
+| Scroll-to-top button | Appears on scroll |
+| Footer with social links | Configurable via `gallery.yaml` |
+| Image count badges | On subpage cover tiles |
+| Custom cursor (crosshair) | On photo grid items |
+| About page | Markdown-driven with portrait + gear |
+| Content Security Policy | CSP + security headers in `next.config.ts` |
+| Album descriptions | Uses Immich's built-in album description field |