feat: add visual admin panel with page builder and settings editor

- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves

app/api/admin/settings/route.ts

@@ -0,0 +1,44 @@
+import { NextResponse } from 'next/server';
+import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
+import { readSettingsYaml, writeSettingsYaml } from '@/lib/admin/yaml-service';
+import { invalidateConfigCache } from '@/lib/config';
+import type { SettingsYaml } from '@/lib/config/schema';
+
+/** GET: Read current settings.yaml config. */
+export async function GET() {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const settings = await readSettingsYaml();
+  return NextResponse.json({ settings: settings || {} });
+}
+
+/** PUT: Write settings.yaml config. */
+export async function PUT(request: Request) {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const body = await request.json().catch(() => null);
+  if (!body?.settings) {
+    return NextResponse.json({ error: 'Missing settings data' }, { status: 400 });
+  }
+
+  const settings = body.settings as SettingsYaml;
+
+  try {
+    await writeSettingsYaml(settings);
+    invalidateConfigCache();
+    return NextResponse.json({ success: true });
+  } catch (err) {
+    console.error('[Admin] Failed to write settings.yaml:', err);
+    return NextResponse.json({ error: 'Failed to save settings' }, { status: 500 });
+  }
+}