feat: multi-user auth with per-user media isolation

Introduce username/password authentication with admin and user roles.
Each user gets their own media directory under /photos/{username}/ with
isolated photos, folders, heaps, and tags. Admins manage users and
observe the full library from a dedicated Settings page.

Backend:
- User model with bcrypt passwords and JWT access/refresh tokens
- Auth router (login, refresh, setup, change-password, status)
- Admin router (user CRUD with last-admin protection)
- user_id FK added to photos, folders, source_roots, heaps, tags
- All data routers scoped by authenticated user
- Scanner inherits user_id from source root owner
- Thumbnails stored under user-prefixed paths for isolation
- Library endpoints accept ?scope=global for admin cross-user view
- Alembic migration 0009 with data migration for existing installs
- Defensive bootstrap.py handles fresh vs existing DB startup

Frontend:
- AuthContext with token lifecycle, auto-refresh, login/logout
- Login page, first-run setup page, auth gate in App.tsx
- Bearer token interceptor on all API requests
- User identity + logout in left sidebar
- Admin-only Settings page with Library Management and Users tabs
- UserManagement panel (add, edit role, reset password, deactivate)
- Settings shows global stats across all users for admin
- Filter bar, right sidebar, keyboard hints hidden on settings page

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/tasks/thumbs.py

@@ -47,9 +47,16 @@ THUMB_SIZES = {
     'large': settings.thumbnails.large
 }
 
-def get_thumb_path(photo_id: str, size: str) -> str:
-    """Get the path for a thumbnail file"""
-    thumb_dir = f"/data/thumbs/{photo_id}"
+def get_thumb_path(photo_id: str, size: str, user_id: str = None) -> str:
+    """Get the path for a thumbnail file.
+
+    When user_id is provided, thumbnails are stored under a user-specific
+    subdirectory to enforce isolation between users.
+    """
+    if user_id:
+        thumb_dir = f"/data/thumbs/{user_id}/{photo_id}"
+    else:
+        thumb_dir = f"/data/thumbs/{photo_id}"
     os.makedirs(thumb_dir, exist_ok=True)
     return f"{thumb_dir}/{size}.{settings.thumbnails.format}"
 
@@ -302,7 +309,7 @@ async def _generate_thumbnails_async(photo_id: str, task):
 
             # Generate thumbnails for each size
             for size_name, size_value in THUMB_SIZES.items():
-                thumb_path = get_thumb_path(photo_id, size_name)
+                thumb_path = get_thumb_path(photo_id, size_name, photo.user_id)
                 generate_thumbnail(image, size_value, thumb_path)
                 
                 # Update database with thumbnail path