fix: dedicate watcher to own worker, fix media auth + memories nav

- Move watch_folders to dedicated 'watcher' queue with its own
  single-concurrency container so it never blocks scan/thumbnail slots
- Add get_current_user_media dependency that accepts ?token= query
  param for <img src> / <video src> media endpoints (thumb, original,
  proxy) — fixes 401 on thumbnails
- Append JWT token to all media URLs in the frontend
- Add missing 'memories' case in sidebar navigation switch

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/dependencies.py

@@ -1,7 +1,9 @@
 """
 FastAPI dependencies for authentication and user-scoped data access.
 """
-from fastapi import Depends, HTTPException, status
+from typing import Optional
+
+from fastapi import Depends, HTTPException, Query, Request, status
 from fastapi.security import OAuth2PasswordBearer
 from jose import JWTError
 from sqlalchemy import select
@@ -45,6 +47,54 @@ async def get_current_user(
     return user
 
 
+async def get_current_user_media(
+    request: Request,
+    token: Optional[str] = Query(None, alias="token"),
+    db: AsyncSession = Depends(get_db),
+) -> User:
+    """Authenticate via Authorization header OR ?token= query parameter.
+
+    Used for media endpoints (thumbnails, originals, proxies) where the
+    URL is set as an <img src> or <video src> and the browser can't
+    attach an Authorization header. The frontend appends ?token=JWT to
+    media URLs so they pass auth without custom fetch logic.
+    """
+    # Try Authorization header first.
+    auth_header = request.headers.get("Authorization", "")
+    jwt_token = None
+    if auth_header.startswith("Bearer "):
+        jwt_token = auth_header[7:]
+    elif token:
+        jwt_token = token
+
+    if not jwt_token:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Missing token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    credentials_exception = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Invalid or expired token",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+    try:
+        payload = decode_token(jwt_token)
+        user_id: str = payload.get("sub")
+        token_type: str = payload.get("type")
+        if user_id is None or token_type != "access":
+            raise credentials_exception
+    except JWTError:
+        raise credentials_exception
+
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if user is None or not user.is_active:
+        raise credentials_exception
+    return user
+
+
 async def require_admin(
     user: User = Depends(get_current_user),
 ) -> User:

backend/app/routers/photos.py

@@ -26,7 +26,7 @@ from app.models.tags import photo_tags
 from app.schemas.photos import PhotoResponse, PhotoUpdate, PhotoListResponse, BulkAction
 from app.services.exif_writer import ExifWriteError, write_taken_at
 from app.services.date_guess import has_date_warning as compute_date_warning
-from app.dependencies import get_current_user, get_user_photo
+from app.dependencies import get_current_user, get_current_user_media, get_user_photo
 from app.config import settings
 
 router = APIRouter()
@@ -506,7 +506,7 @@ async def get_thumbnail(
     size: str,
     response: Response,
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(get_current_user_media),
 ):
     """Serve thumbnail (with Nginx X-Accel-Redirect support)"""
     if size not in ['small', 'medium', 'large']:
@@ -593,7 +593,7 @@ async def get_thumbnail(
 async def get_original(
     photo_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(get_current_user_media),
 ):
     """Serve original file (download for RAW, inline for web-safe formats)"""
     photo = await get_user_photo(photo_id, current_user, db)
@@ -696,7 +696,7 @@ async def get_proxy(
     photo_id: str,
     response: Response,
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(get_current_user_media),
 ):
     """Serve a full-resolution WebP proxy for non-web-safe formats."""
     photo = await get_user_photo(photo_id, current_user, db)

backend/app/tasks/celery.py

@@ -29,6 +29,7 @@ celery_app.conf.update(
         'extract_faces': {'queue': 'vision'},
         'classify_content': {'queue': 'vision'},
         'vision_fanout': {'queue': 'vision'},
+        'watch_folders': {'queue': 'watcher'},
     },
     task_default_queue='default',
     task_default_exchange='default',

docker-compose.yml

@@ -120,6 +120,37 @@ services:
       - mulita-network
     restart: unless-stopped
 
+  # Dedicated watcher worker — runs the long-lived watch_folders task
+  # on its own queue so it never blocks scan/thumbnail workers.
+  worker-watcher:
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+    image: mule-image-worker
+    container_name: mulita-worker-watcher
+    command: sh -c "celery -A app.tasks.celery worker --loglevel=${LOG_LEVEL:-info} --concurrency=1 -Q watcher -n watcher@%h"
+    volumes:
+      - ./mulita.yml:/app/config/mulita.yml:ro
+      - ${PHOTO_DIRS:-./photos}:/photos:rw
+      - db_data:/data/db
+    environment:
+      - DATABASE_URL=postgresql+asyncpg://mulita:mulita@db:5432/mulita
+      - REDIS_URL=redis://redis:6379
+      - CELERY_BROKER_URL=redis://redis:6379
+      - CELERY_RESULT_BACKEND=redis://redis:6379
+      - PHOTO_DIRS=${PHOTO_DIRS:-/photos}
+      - LOG_LEVEL=${LOG_LEVEL:-INFO}
+      - TZ=${TZ:-UTC}
+      - MULITA_CELERY_WORKER=1
+    depends_on:
+      redis:
+        condition: service_started
+      db:
+        condition: service_healthy
+    networks:
+      - mulita-network
+    restart: unless-stopped
+
   worker-vision:
     build:
       context: ./backend

frontend/src/components/layout/LeftSidebar.tsx

@@ -276,6 +276,9 @@ export function LeftSidebar({ onCollapse }: LeftSidebarProps) {
       case 'map':
         navigateToSection('map', {})
         break
+      case 'memories':
+        navigateToSection('memories', {})
+        break
       default:
         if (id.startsWith('folder-')) {
           const folderId = id.slice('folder-'.length)

frontend/src/components/memories/MemoriesView.tsx

@@ -1,5 +1,5 @@
 import { useQuery } from '@tanstack/react-query'
-import { photos } from '../../services/api'
+import { photos, photos as photosApi } from '../../services/api'
 import type { MemoryGroup } from '../../services/api'
 
 export function MemoriesView() {
@@ -47,7 +47,7 @@ export function MemoriesView() {
               >
                 {photo.thumb_small ? (
                   <img
-                    src={`/api/v1/photos/${photo.id}/thumb/small`}
+                    src={photosApi.getThumbnailUrl(photo.id, 'small')}
                     alt={photo.filename}
                     className="w-full h-full object-cover"
                     loading="lazy"

frontend/src/services/api.ts

@@ -316,17 +316,23 @@ export const photos = {
   },
 
   getThumbnailUrl: (photoId: string, size: 'small' | 'medium' | 'large' = 'medium') => {
-    return `${API_BASE_URL}/photos/${photoId}/thumb/${size}`
+    const token = localStorage.getItem('access_token')
+    const qs = token ? `?token=${encodeURIComponent(token)}` : ''
+    return `${API_BASE_URL}/photos/${photoId}/thumb/${size}${qs}`
   },
 
   getOriginalUrl: (photoId: string) => {
-    return `${API_BASE_URL}/photos/${photoId}/original`
+    const token = localStorage.getItem('access_token')
+    const qs = token ? `?token=${encodeURIComponent(token)}` : ''
+    return `${API_BASE_URL}/photos/${photoId}/original${qs}`
   },
 
   /** Full-resolution display URL. Backend serves the original for web-safe
    *  formats and a transcoded WebP for RAW/HEIC/TIFF. */
   getProxyUrl: (photoId: string) => {
-    return `${API_BASE_URL}/photos/${photoId}/proxy`
+    const token = localStorage.getItem('access_token')
+    const qs = token ? `?token=${encodeURIComponent(token)}` : ''
+    return `${API_BASE_URL}/photos/${photoId}/proxy${qs}`
   },
 
   /** "On this day" memories — photos taken on this date in previous years. */