feat(sidecar): extend scoped proxy to web-client mutations, harden path classification

Batch archive/restore/delete/approve/private validate every UID against
the PhotoPrism DB in one query. Per-photo PUT/approve/like/stack-file
ops are ownership-checked. Admin-role sessions pass through fully so
settings/users/index dialogs keep working. Paths are unescaped+cleaned
before classification so encoded dot-segments can't smuggle past the
allowlist. Full httptest coverage of the routing decisions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sidecar/handlers_dups.go

@@ -25,10 +25,10 @@ type dupFileLite struct {
 }
 
 type dupGroup struct {
-	Hash         string        `json:"hash"`
-	Size         int64         `json:"size"`
-	IndexedPath  *string       `json:"indexedPath"`
-	Files        []dupFileLite `json:"files"`
+	Hash        string        `json:"hash"`
+	Size        int64         `json:"size"`
+	IndexedPath *string       `json:"indexedPath"`
+	Files       []dupFileLite `json:"files"`
 }
 
 // dupListPhoto is the partial photo shape we pull from PhotoPrism when