Add photo galleries API and frontend for public and admin viewing.

Introduces the Go photo-api service, nginx/systemd deploy wiring, and Next.js gallery/lightbox pages so event photos can be managed and browsed.

Co-authored-by: Cursor <cursoragent@cursor.com>

photo-api/.env.example

@@ -0,0 +1,43 @@
+# Spanglish photo-api configuration
+# Copy to .env — the service loads it on start (systemd also passes it via
+# EnvironmentFile). This service has its own .env; nothing is shared with
+# backend/.env except the VALUES of JWT_SECRET and DATABASE_URL.
+
+# Port (dev default 3003; the systemd unit overrides to 3020 in production)
+PORT=3003
+
+# Database — the SAME database the backend uses. photo-api owns only the
+# photos_* tables (created by `photo-api migrate`) and reads users/events/
+# tickets/payments for auth and access checks.
+# DB_TYPE must match the backend's engine: postgres | sqlite
+DB_TYPE=postgres
+DATABASE_URL=postgresql://spanglish:password@localhost:5432/spanglish_db
+# For sqlite instead:
+# DB_TYPE=sqlite
+# DATABASE_URL=../backend/data/spanglish.db
+
+# MUST be identical to JWT_SECRET in backend/.env — photo-api validates the
+# same HS256 tokens the backend issues.
+JWT_SECRET=
+
+# Public site origin, used to build share links and allow dev CORS
+FRONTEND_URL=https://spanglishcommunity.com
+
+# Photo storage. Local disk by default; setting BOTH S3_ENDPOINT and
+# S3_BUCKET switches to S3 (same convention as the backend's media storage).
+# Use a photos-specific bucket — do not reuse the backend's media bucket.
+STORAGE_PATH=./data/photos
+#S3_ENDPOINT=
+#S3_REGION=auto
+#S3_BUCKET=spanglish-photos
+#S3_ACCESS_KEY_ID=
+#S3_SECRET_ACCESS_KEY=
+#S3_FORCE_PATH_STYLE=true
+
+# Upload and processing tuning
+MAX_UPLOAD_MB=50
+WORKER_CONCURRENCY=2
+
+# HEIC conversion shells out to a host-installed CLI (autodetects `vips`
+# then `heif-convert`; Debian: apt install libvips-tools). Set to override.
+#HEIC_CONVERTER=