feat: photography features & image optimizations

- Hero carousel: gallery.yaml hero accepts single UUID or array, crossfade component
- Full-bleed single albums: subpages with 1 album skip grid, render photos directly
- EXIF on hover: camera/lens/focal length overlay on grid items (toggle via exifOnHover)
- Customizable grid: columns/gap/aspectRatio/layout (masonry|uniform) via gallery.yaml
- Per-subpage grid overrides: each subpage can override global grid config
- True masonry: per-image aspect ratios from EXIF dimensions
- next/image migration: homepage hero, album covers, grid thumbnails, about portrait
- ThumbHash blur placeholders and dominant color backgrounds
- Custom next/image loader via image proxy with width/quality params
- Lightbox fade-in transition with dominant color background
- Password-protected subpages, health check, rate limiting, OG images

components/PasswordGate.tsx

@@ -0,0 +1,76 @@
+'use client';
+
+/**
+ * Password gate — shown when accessing a protected album/subpage.
+ * Submits to /api/auth and refreshes on success.
+ */
+
+import { useState } from 'react';
+
+interface PasswordGateProps {
+    slug: string;
+    title: string;
+}
+
+export default function PasswordGate({ slug, title }: PasswordGateProps) {
+    const [password, setPassword] = useState('');
+    const [error, setError] = useState('');
+    const [loading, setLoading] = useState(false);
+
+    async function handleSubmit(e: React.FormEvent) {
+        e.preventDefault();
+        setError('');
+        setLoading(true);
+
+        try {
+            const res = await fetch('/api/auth', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ slug, password }),
+            });
+
+            if (res.ok) {
+                window.location.reload();
+            } else {
+                setError('Wrong password');
+                setPassword('');
+            }
+        } catch {
+            setError('Something went wrong');
+        } finally {
+            setLoading(false);
+        }
+    }
+
+    return (
+        <div className="password-gate">
+            <div className="password-gate__card">
+                <h2 className="password-gate__title">{title}</h2>
+                <p className="password-gate__subtitle">
+                    This gallery is password-protected.
+                </p>
+
+                <form onSubmit={handleSubmit} className="password-gate__form">
+                    <input
+                        type="password"
+                        value={password}
+                        onChange={(e) => setPassword(e.target.value)}
+                        placeholder="Enter password"
+                        className="password-gate__input"
+                        autoFocus
+                        required
+                    />
+                    <button
+                        type="submit"
+                        className="password-gate__button"
+                        disabled={loading}
+                    >
+                        {loading ? 'Verifying…' : 'Enter'}
+                    </button>
+                </form>
+
+                {error && <p className="password-gate__error">{error}</p>}
+            </div>
+        </div>
+    );
+}