Add view tokens for non-public gallery images and per-mode gate pages.

<img> tags cannot send Authorization headers, so non-public gallery photos
were invisible even to authorized viewers. The server now mints short-lived
HMAC view tokens (gallery-scoped, hour-bucketed) and embeds them in every
file URL for non-public galleries. Access denials return distinct 403
messages per visibility mode, and the frontend renders a matching gate page
(private, link-only, ticket-holders, login prompt) with an inline login
modal so visitors never leave the gallery page.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

photo-api/internal/httpapi/public.go

@@ -56,12 +56,10 @@ func (s *Server) respondGalleryView(w http.ResponseWriter, r *http.Request, g st
 		return
 	}
 
-	// Only pass the token through to file URLs when it was the granting
-	// credential, so it doesn't leak into public/ticket responses.
-	urlToken := ""
-	if token != "" && token == g.ShareToken {
-		urlToken = token
-	}
+	// Non-public galleries get a short-lived view token on every file URL,
+	// because the browser's <img> requests cannot carry the Bearer header
+	// that authorized this gallery fetch. Public galleries need none.
+	urlToken := s.viewTokenFor(g)
 
 	photos, err := s.db.ListPhotos(r.Context(), g.ID, true)
 	if err != nil {