feat: add visual admin panel with page builder and settings editor

- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves

app/api/admin/gallery/route.ts

@@ -0,0 +1,48 @@
+import { NextResponse } from 'next/server';
+import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
+import { readGalleryYaml, writeGalleryYaml } from '@/lib/admin/yaml-service';
+import { invalidateConfigCache } from '@/lib/config';
+import type { GalleryYaml } from '@/lib/config/schema';
+
+/** GET: Read current gallery.yaml config. */
+export async function GET() {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const gallery = await readGalleryYaml();
+  return NextResponse.json({ gallery: gallery || { hero: [], albums: [], subpages: [] } });
+}
+
+/** PUT: Write gallery.yaml config. */
+export async function PUT(request: Request) {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const body = await request.json().catch(() => null);
+  if (!body?.gallery) {
+    return NextResponse.json({ error: 'Missing gallery data' }, { status: 400 });
+  }
+
+  // Validate basic structure
+  const gallery = body.gallery as GalleryYaml;
+  if (!Array.isArray(gallery.hero) && typeof gallery.hero !== 'string' && gallery.hero != null) {
+    return NextResponse.json({ error: 'Invalid hero format' }, { status: 400 });
+  }
+
+  try {
+    await writeGalleryYaml(gallery);
+    invalidateConfigCache();
+    return NextResponse.json({ success: true });
+  } catch (err) {
+    console.error('[Admin] Failed to write gallery.yaml:', err);
+    return NextResponse.json({ error: 'Failed to save gallery config' }, { status: 500 });
+  }
+}