feat: add visual admin panel with page builder and settings editor

- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves

app/api/admin/auth/route.ts

@@ -0,0 +1,64 @@
+import { NextRequest, NextResponse } from 'next/server';
+import {
+  verifyAdminPassword,
+  createAdminToken,
+  isAdminAuthenticated,
+  isAdminEnabled,
+  COOKIE_NAME,
+  SESSION_DURATION_MS,
+} from '@/lib/admin/auth';
+
+/** POST: Login with admin password. */
+export async function POST(request: NextRequest) {
+  if (!isAdminEnabled()) {
+    return NextResponse.json(
+      { error: 'Admin panel is not enabled. Set ADMIN_PASSWORD in your environment.' },
+      { status: 403 },
+    );
+  }
+
+  const body = await request.json().catch(() => null);
+  if (!body?.password || typeof body.password !== 'string') {
+    return NextResponse.json({ error: 'Password is required' }, { status: 400 });
+  }
+
+  if (!verifyAdminPassword(body.password)) {
+    return NextResponse.json({ error: 'Invalid password' }, { status: 401 });
+  }
+
+  const token = createAdminToken();
+  const response = NextResponse.json({ success: true });
+
+  response.cookies.set(COOKIE_NAME, token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'strict',
+    path: '/',
+    maxAge: SESSION_DURATION_MS / 1000,
+  });
+
+  return response;
+}
+
+/** GET: Check session status. */
+export async function GET() {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ authenticated: false, enabled: false });
+  }
+
+  const authenticated = await isAdminAuthenticated();
+  return NextResponse.json({ authenticated, enabled: true });
+}
+
+/** DELETE: Logout. */
+export async function DELETE() {
+  const response = NextResponse.json({ success: true });
+  response.cookies.set(COOKIE_NAME, '', {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'strict',
+    path: '/',
+    maxAge: 0,
+  });
+  return response;
+}