feat: photography features & image optimizations

- Hero carousel: gallery.yaml hero accepts single UUID or array, crossfade component
- Full-bleed single albums: subpages with 1 album skip grid, render photos directly
- EXIF on hover: camera/lens/focal length overlay on grid items (toggle via exifOnHover)
- Customizable grid: columns/gap/aspectRatio/layout (masonry|uniform) via gallery.yaml
- Per-subpage grid overrides: each subpage can override global grid config
- True masonry: per-image aspect ratios from EXIF dimensions
- next/image migration: homepage hero, album covers, grid thumbnails, about portrait
- ThumbHash blur placeholders and dominant color backgrounds
- Custom next/image loader via image proxy with width/quality params
- Lightbox fade-in transition with dominant color background
- Password-protected subpages, health check, rate limiting, OG images

app/api/auth/route.ts

@@ -0,0 +1,46 @@
+/**
+ * Auth API — validates album passwords and sets auth cookies.
+ * POST /api/auth { slug, password }
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { authenticate, isProtected } from '@/lib/auth';
+
+export async function POST(request: NextRequest) {
+    try {
+        const body = await request.json();
+        const { slug, password } = body;
+
+        if (!slug || !password) {
+            return NextResponse.json(
+                { error: 'Missing slug or password' },
+                { status: 400 },
+            );
+        }
+
+        if (!isProtected(slug)) {
+            return NextResponse.json(
+                { error: 'Album is not password-protected' },
+                { status: 400 },
+            );
+        }
+
+        const setCookie = authenticate(slug, password);
+        if (!setCookie) {
+            return NextResponse.json(
+                { error: 'Invalid password' },
+                { status: 401 },
+            );
+        }
+
+        return NextResponse.json(
+            { success: true },
+            { headers: { 'Set-Cookie': setCookie } },
+        );
+    } catch {
+        return NextResponse.json(
+            { error: 'Invalid request body' },
+            { status: 400 },
+        );
+    }
+}