feat: multi-user auth with per-user media isolation

Introduce username/password authentication with admin and user roles.
Each user gets their own media directory under /photos/{username}/ with
isolated photos, folders, heaps, and tags. Admins manage users and
observe the full library from a dedicated Settings page.

Backend:
- User model with bcrypt passwords and JWT access/refresh tokens
- Auth router (login, refresh, setup, change-password, status)
- Admin router (user CRUD with last-admin protection)
- user_id FK added to photos, folders, source_roots, heaps, tags
- All data routers scoped by authenticated user
- Scanner inherits user_id from source root owner
- Thumbnails stored under user-prefixed paths for isolation
- Library endpoints accept ?scope=global for admin cross-user view
- Alembic migration 0009 with data migration for existing installs
- Defensive bootstrap.py handles fresh vs existing DB startup

Frontend:
- AuthContext with token lifecycle, auto-refresh, login/logout
- Login page, first-run setup page, auth gate in App.tsx
- Bearer token interceptor on all API requests
- User identity + logout in left sidebar
- Admin-only Settings page with Library Management and Users tabs
- UserManagement panel (add, edit role, reset password, deactivate)
- Settings shows global stats across all users for admin
- Filter bar, right sidebar, keyboard hints hidden on settings page

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/tasks/scan.py

@@ -122,6 +122,13 @@ async def _scan_folder_async(folder_path: str, source_root_id: Optional[str], ta
             if not source_root_id:
                 source_root = await get_or_create_source_root(session, folder_path)
                 source_root_id = source_root.id
+            else:
+                source_root = (await session.execute(
+                    select(SourceRoot).where(SourceRoot.id == source_root_id)
+                )).scalar_one_or_none()
+
+            # Inherit user_id from the source root's owner
+            owner_user_id = source_root.user_id if source_root else None
 
             # Per-scan memoization cache for "is this folder's effective
             # is_hidden true?" Populated on first lookup by walking the
@@ -173,7 +180,7 @@ async def _scan_folder_async(folder_path: str, source_root_id: Optional[str], ta
 
             for root, dirs, files in os.walk(folder_path):
                 # Get or create folder entry
-                folder = await get_or_create_folder(session, root, source_root_id)
+                folder = await get_or_create_folder(session, root, source_root_id, owner_user_id)
                 progress_set(REDIS_KEY_CURRENT_FOLDER, root)
 
                 # Filter supported files
@@ -237,6 +244,7 @@ async def _scan_folder_async(folder_path: str, source_root_id: Optional[str], ta
                                 filepath=filepath,
                                 filename=filename,
                                 folder_id=folder.id,
+                                user_id=owner_user_id,
                                 file_hash=file_hash,
                                 media_type=get_media_type(filepath),
                                 original_format=Path(filepath).suffix.upper()[1:],
@@ -342,7 +350,9 @@ async def get_or_create_source_root(session: AsyncSession, path: str) -> SourceR
     return source_root
 
 
-async def get_or_create_folder(session: AsyncSession, path: str, source_root_id: str) -> Folder:
+async def get_or_create_folder(
+    session: AsyncSession, path: str, source_root_id: str, user_id: str = None
+) -> Folder:
     """Get or create a folder entry, matching by normalized path."""
     from sqlalchemy import select
 
@@ -364,7 +374,7 @@ async def get_or_create_folder(session: AsyncSession, path: str, source_root_id:
                 parent_id = parent.id
             else:
                 # Recursively create parent
-                parent = await get_or_create_folder(session, parent_path, source_root_id)
+                parent = await get_or_create_folder(session, parent_path, source_root_id, user_id)
                 parent_id = parent.id
         else:
             parent_id = None
@@ -374,6 +384,7 @@ async def get_or_create_folder(session: AsyncSession, path: str, source_root_id:
             path=norm,
             parent_id=parent_id,
             source_root_id=source_root_id,
+            user_id=user_id,
         )
         session.add(folder)
         await session.flush()