fix: dedicate watcher to own worker, fix media auth + memories nav

- Move watch_folders to dedicated 'watcher' queue with its own
  single-concurrency container so it never blocks scan/thumbnail slots
- Add get_current_user_media dependency that accepts ?token= query
  param for <img src> / <video src> media endpoints (thumb, original,
  proxy) — fixes 401 on thumbnails
- Append JWT token to all media URLs in the frontend
- Add missing 'memories' case in sidebar navigation switch

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -120,6 +120,37 @@ services:
       - mulita-network
     restart: unless-stopped
 
+  # Dedicated watcher worker — runs the long-lived watch_folders task
+  # on its own queue so it never blocks scan/thumbnail workers.
+  worker-watcher:
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+    image: mule-image-worker
+    container_name: mulita-worker-watcher
+    command: sh -c "celery -A app.tasks.celery worker --loglevel=${LOG_LEVEL:-info} --concurrency=1 -Q watcher -n watcher@%h"
+    volumes:
+      - ./mulita.yml:/app/config/mulita.yml:ro
+      - ${PHOTO_DIRS:-./photos}:/photos:rw
+      - db_data:/data/db
+    environment:
+      - DATABASE_URL=postgresql+asyncpg://mulita:mulita@db:5432/mulita
+      - REDIS_URL=redis://redis:6379
+      - CELERY_BROKER_URL=redis://redis:6379
+      - CELERY_RESULT_BACKEND=redis://redis:6379
+      - PHOTO_DIRS=${PHOTO_DIRS:-/photos}
+      - LOG_LEVEL=${LOG_LEVEL:-INFO}
+      - TZ=${TZ:-UTC}
+      - MULITA_CELERY_WORKER=1
+    depends_on:
+      redis:
+        condition: service_started
+      db:
+        condition: service_healthy
+    networks:
+      - mulita-network
+    restart: unless-stopped
+
   worker-vision:
     build:
       context: ./backend