fix: keep /admin reachable while setup is required (#392)

The root layout replaced the entire app with the SetupScreen whenever
the config was incomplete (missing gallery.yaml or Immich credentials)
— including /admin, which lives under the same root layout. That locked
users out of the very tool that fixes an incomplete configuration.

The middleware now forwards the request pathname via an x-pathname
header, and the root layout skips the setup screen for admin paths, so
/admin renders normally (login when ADMIN_PASSWORD is set, the
enable-hint otherwise) while every other route keeps showing the setup
instructions.

Fixes #326

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/admin/paths.ts

@@ -0,0 +1,12 @@
+/**
+ * Whether a request pathname belongs to the admin panel.
+ *
+ * Used by the root layout to keep /admin reachable while the app is in
+ * setup mode: the setup screen must not lock out the very tool that fixes
+ * an incomplete configuration (#326). A null pathname (header missing,
+ * e.g. a route not covered by the middleware matcher) counts as non-admin
+ * so the setup screen remains the safe default.
+ */
+export function isAdminPath(pathname: string | null): boolean {
+  return pathname === '/admin' || pathname?.startsWith('/admin/') === true;
+}