feat: multi-user auth with per-user media isolation

Introduce username/password authentication with admin and user roles.
Each user gets their own media directory under /photos/{username}/ with
isolated photos, folders, heaps, and tags. Admins manage users and
observe the full library from a dedicated Settings page.

Backend:
- User model with bcrypt passwords and JWT access/refresh tokens
- Auth router (login, refresh, setup, change-password, status)
- Admin router (user CRUD with last-admin protection)
- user_id FK added to photos, folders, source_roots, heaps, tags
- All data routers scoped by authenticated user
- Scanner inherits user_id from source root owner
- Thumbnails stored under user-prefixed paths for isolation
- Library endpoints accept ?scope=global for admin cross-user view
- Alembic migration 0009 with data migration for existing installs
- Defensive bootstrap.py handles fresh vs existing DB startup

Frontend:
- AuthContext with token lifecycle, auto-refresh, login/logout
- Login page, first-run setup page, auth gate in App.tsx
- Bearer token interceptor on all API requests
- User identity + logout in left sidebar
- Admin-only Settings page with Library Management and Users tabs
- UserManagement panel (add, edit role, reset password, deactivate)
- Settings shows global stats across all users for admin
- Filter bar, right sidebar, keyboard hints hidden on settings page

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/services/scanner.py

@@ -1,6 +1,5 @@
 """
-Scanner service for initial library scan and one-time bootstrap of the
-default source root on first boot.
+Scanner service for initial library scan and per-user source root bootstrap.
 """
 import os
 import logging
@@ -8,44 +7,74 @@ from sqlalchemy import select
 
 from app.database import AsyncSessionLocal
 from app.models import SourceRoot
+from app.models.user import User
 from app.tasks.scan import scan_all_source_roots
 from app.config import settings
 
 logger = logging.getLogger(__name__)
 
-# The single host → container mount path. The compose file mounts whatever
-# the user set as PHOTO_DIRS at this path.
-DEFAULT_LIBRARY_PATH = "/photos"
-DEFAULT_LIBRARY_NAME = "Library"
+
+async def bootstrap_user_source_root(user: User, session=None) -> None:
+    """Create the media directory and a source root for a user.
+
+    Called when a new user is created (by the admin or the setup endpoint).
+    If the user already has a source root, this is a no-op.
+    """
+    own_session = session is None
+    if own_session:
+        session = AsyncSessionLocal()
+
+    try:
+        # Check if user already has a source root
+        result = await session.execute(
+            select(SourceRoot).where(SourceRoot.user_id == user.id)
+        )
+        if result.scalar_one_or_none() is not None:
+            return
+
+        os.makedirs(user.media_path, exist_ok=True)
+
+        source_root = SourceRoot(
+            name=f"{user.username}'s Library",
+            path=user.media_path,
+            user_id=user.id,
+        )
+        session.add(source_root)
+        if own_session:
+            await session.commit()
+        else:
+            await session.flush()
+
+        logger.info(
+            f"Bootstrapped source root for user '{user.username}': "
+            f"{user.media_path}"
+        )
+    finally:
+        if own_session:
+            await session.close()
 
 
 async def bootstrap_default_source_root() -> None:
-    """If no source roots exist in the DB, create one pointing at the default
-    library mount. Lets a fresh install pick up photos with zero
-    configuration: the user only needs to set PHOTO_DIRS in .env.
+    """Legacy bootstrap — for existing installs that have source roots
+    without user_id (pre-auth migration). On fresh installs, source roots
+    are created per-user via bootstrap_user_source_root. If there are
+    already source roots in the DB, this is a no-op.
     """
-    if not os.path.isdir(DEFAULT_LIBRARY_PATH):
-        logger.warning(
-            f"Default library path {DEFAULT_LIBRARY_PATH} is not mounted; "
-            "set PHOTO_DIRS in .env and recreate the container."
-        )
-        return
-
     async with AsyncSessionLocal() as session:
         result = await session.execute(select(SourceRoot))
         if result.scalars().first() is not None:
-            return  # Already have at least one source root, leave it alone.
+            return  # Already have source roots.
 
-        source_root = SourceRoot(
-            name=DEFAULT_LIBRARY_NAME,
-            path=DEFAULT_LIBRARY_PATH,
-        )
-        session.add(source_root)
-        await session.commit()
-        logger.info(
-            f"Bootstrapped default source root: {DEFAULT_LIBRARY_NAME} → "
-            f"{DEFAULT_LIBRARY_PATH}"
-        )
+        # No source roots and no users means fresh install — the setup
+        # endpoint will create the first user + source root.
+        user_count = (await session.execute(
+            select(User)
+        )).scalars().first()
+        if user_count is None:
+            logger.info(
+                "No users or source roots — waiting for first-run setup."
+            )
+            return
 
 
 async def start_initial_scan():