fix: dedicate watcher to own worker, fix media auth + memories nav

- Move watch_folders to dedicated 'watcher' queue with its own
  single-concurrency container so it never blocks scan/thumbnail slots
- Add get_current_user_media dependency that accepts ?token= query
  param for <img src> / <video src> media endpoints (thumb, original,
  proxy) — fixes 401 on thumbnails
- Append JWT token to all media URLs in the frontend
- Add missing 'memories' case in sidebar navigation switch

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/routers/photos.py

@@ -26,7 +26,7 @@ from app.models.tags import photo_tags
 from app.schemas.photos import PhotoResponse, PhotoUpdate, PhotoListResponse, BulkAction
 from app.services.exif_writer import ExifWriteError, write_taken_at
 from app.services.date_guess import has_date_warning as compute_date_warning
-from app.dependencies import get_current_user, get_user_photo
+from app.dependencies import get_current_user, get_current_user_media, get_user_photo
 from app.config import settings
 
 router = APIRouter()
@@ -506,7 +506,7 @@ async def get_thumbnail(
     size: str,
     response: Response,
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(get_current_user_media),
 ):
     """Serve thumbnail (with Nginx X-Accel-Redirect support)"""
     if size not in ['small', 'medium', 'large']:
@@ -593,7 +593,7 @@ async def get_thumbnail(
 async def get_original(
     photo_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(get_current_user_media),
 ):
     """Serve original file (download for RAW, inline for web-safe formats)"""
     photo = await get_user_photo(photo_id, current_user, db)
@@ -696,7 +696,7 @@ async def get_proxy(
     photo_id: str,
     response: Response,
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(get_current_user_media),
 ):
     """Serve a full-resolution WebP proxy for non-web-safe formats."""
     photo = await get_user_photo(photo_id, current_user, db)