feat: simplify folder setup — single mount, auto bootstrap, browser dialog

Cleans up the maze of overlapping ways folders entered the app, plus
removes the dead trash plumbing left over from the soft-discard
refactor.

Setup model (now)
- ONE env var: PHOTO_DIRS in .env, set to the host path of your
  library. Compose mounts that at /photos. That's the entire setup.
- On first boot, the backend auto-creates a SourceRoot row named
  "Library" pointing at /photos so the user sees their photos
  immediately without configuring anything.
- Source roots and discard live in the database; mulita.yml only
  carries operational settings (thumbnails, scanner, performance).
- The "Add Source Folder" dialog is now a directory browser
  restricted server-side to /photos and any existing source root —
  the user clicks through actual mounted directories instead of
  typing container paths they can't possibly know.

Backend
- New services/scanner.bootstrap_default_source_root(): if no
  SourceRoot rows exist and /photos is mounted, create one. Wired
  into the lifespan handler before cleanup + initial scan.
- New GET /library/browse?path= returning the immediate child
  directories of `path`, validated to live under one of the allowed
  roots (default mount + every active SourceRoot). Hidden entries
  are filtered. Children are tagged with is_existing_root so the UI
  can show an "Added" badge. Returns parent path for up-nav, or
  null when at the top of the allowed scope.
- scan_all_source_roots now reads from the DB instead of the YAML
  config so DB-managed source roots are honoured by initial scan.
- Dropped the placeholder source_roots block from mulita.yml — the
  paths /photos/main and /photos/iphone never existed and just
  produced startup warnings.
- Dropped TrashSettings, settings.trash, settings.source_roots,
  and the SourceRoot pydantic model from config.py. Soft discard
  has owned this for a while; it was dead code.

Compose
- Single ${PHOTO_DIRS:-./photos}:/photos:rw mount in both backend
  and worker.
- Removed the hardcoded ~/Pictures:/host/Pictures:rw mount — the
  PHOTO_DIRS variable is the single source of truth now.
- Removed the trash_data named volume + mounts (no consumers).
- backend/Dockerfile no longer creates /data/trash; it now creates
  /data/proxies (which the proxy endpoint actually uses).

Frontend
- AddSourceFolderDialog rewritten as a directory tree picker:
  loads /library/browse on open, lets the user navigate up via a
  ChevronUp button or down by clicking subfolders, shows the
  current path inline, and adds whatever directory is currently
  shown. Existing source roots are tagged "Added" so the user
  knows what's already registered. Errors from the backend (e.g.
  trying to navigate outside the allowed scope) surface inline.
- New library.browse() helper + BrowseChild / BrowseResponse types
  in services/api.ts.

Docs
- README Quick Start rewritten around the single PHOTO_DIRS env
  var, with macOS/Linux/Windows examples.
- New "How mounted folders and source folders relate" section that
  spells out the two-layer model (mount = visibility, source root
  = scanning) so the most common confusion is addressed up front.
- Added a "Read-only libraries" subsection that lists exactly which
  endpoints fail under :ro.
- "Configuration" section reframed: source roots are managed by the
  UI/API now, mulita.yml is operational settings only.
- .env file now has examples for the common host paths.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/routers/library.py

@@ -1,15 +1,21 @@
 """
-Library API router for stats and scanning
+Library API router for stats, scanning, and directory browsing
 """
-from fastapi import APIRouter, Depends
+import os
+from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy import select, func
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.database import get_db
-from app.models import Photo
+from app.models import Photo, SourceRoot
 
 router = APIRouter()
 
+
+# Always-allowed root for the directory browser. Whatever the user mounts
+# as PHOTO_DIRS in .env shows up here.
+DEFAULT_LIBRARY_ROOT = "/photos"
+
 @router.get("/stats")
 async def get_library_stats(db: AsyncSession = Depends(get_db)):
     """Get library statistics"""
@@ -38,6 +44,89 @@ async def get_library_stats(db: AsyncSession = Depends(get_db)):
         "total_size_gb": round(size / (1024**3), 2) if size else 0
     }
 
+@router.get("/browse")
+async def browse_directory(
+    path: str = DEFAULT_LIBRARY_ROOT,
+    db: AsyncSession = Depends(get_db),
+):
+    """List the immediate child directories of `path` so the frontend can
+    render a folder picker. The path is validated to live under one of the
+    allowed roots so this can't be used to enumerate the container
+    filesystem:
+
+      - The default library mount (/photos)
+      - Any active SourceRoot the user has already added (and its subtree)
+
+    Returns:
+      {
+        "path": str,             # canonical (normalized) path
+        "parent": str | null,    # parent path if still inside an allowed root
+        "is_existing_root": bool # whether `path` is itself a SourceRoot
+        "children": [
+          { "name", "path", "is_existing_root" }, ...
+        ]
+      }
+    """
+    # Build the allowed-roots set: default mount + every active SourceRoot.
+    sr_result = await db.execute(
+        select(SourceRoot).where(SourceRoot.is_active == True)  # noqa: E712
+    )
+    source_roots = sr_result.scalars().all()
+    sr_paths = [os.path.normpath(sr.path) for sr in source_roots]
+    allowed_roots = {os.path.normpath(DEFAULT_LIBRARY_ROOT), *sr_paths}
+
+    canonical = os.path.normpath(path)
+
+    # Path must live under (or be) one of the allowed roots — prevents
+    # browsing /etc, /data/db, etc.
+    def under_allowed(p: str) -> bool:
+        for root in allowed_roots:
+            if p == root or p.startswith(root + os.sep):
+                return True
+        return False
+
+    if not under_allowed(canonical):
+        raise HTTPException(
+            status_code=403,
+            detail=f"Path is outside the allowed photo roots",
+        )
+
+    if not os.path.isdir(canonical):
+        raise HTTPException(status_code=404, detail=f"Not a directory: {canonical}")
+
+    # Build the child list — only directories, hidden entries (dotfiles)
+    # excluded.
+    sr_path_set = set(sr_paths)
+    try:
+        entries = sorted(os.listdir(canonical))
+    except OSError as e:
+        raise HTTPException(status_code=500, detail=f"Cannot read directory: {e}")
+
+    children = []
+    for entry in entries:
+        if entry.startswith('.'):
+            continue
+        child_path = os.path.join(canonical, entry)
+        if not os.path.isdir(child_path):
+            continue
+        children.append({
+            "name": entry,
+            "path": child_path,
+            "is_existing_root": child_path in sr_path_set,
+        })
+
+    # Compute parent path if it's still inside an allowed root.
+    parent = os.path.normpath(os.path.dirname(canonical))
+    parent_in_scope = parent != canonical and under_allowed(parent)
+
+    return {
+        "path": canonical,
+        "parent": parent if parent_in_scope else None,
+        "is_existing_root": canonical in sr_path_set,
+        "children": children,
+    }
+
+
 @router.post("/scan")
 async def trigger_scan():
     """Trigger full library re-scan"""