fix: dedicate watcher to own worker, fix media auth + memories nav

- Move watch_folders to dedicated 'watcher' queue with its own
  single-concurrency container so it never blocks scan/thumbnail slots
- Add get_current_user_media dependency that accepts ?token= query
  param for <img src> / <video src> media endpoints (thumb, original,
  proxy) — fixes 401 on thumbnails
- Append JWT token to all media URLs in the frontend
- Add missing 'memories' case in sidebar navigation switch

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/services/api.ts

@@ -316,17 +316,23 @@ export const photos = {
   },
 
   getThumbnailUrl: (photoId: string, size: 'small' | 'medium' | 'large' = 'medium') => {
-    return `${API_BASE_URL}/photos/${photoId}/thumb/${size}`
+    const token = localStorage.getItem('access_token')
+    const qs = token ? `?token=${encodeURIComponent(token)}` : ''
+    return `${API_BASE_URL}/photos/${photoId}/thumb/${size}${qs}`
   },
 
   getOriginalUrl: (photoId: string) => {
-    return `${API_BASE_URL}/photos/${photoId}/original`
+    const token = localStorage.getItem('access_token')
+    const qs = token ? `?token=${encodeURIComponent(token)}` : ''
+    return `${API_BASE_URL}/photos/${photoId}/original${qs}`
   },
 
   /** Full-resolution display URL. Backend serves the original for web-safe
    *  formats and a transcoded WebP for RAW/HEIC/TIFF. */
   getProxyUrl: (photoId: string) => {
-    return `${API_BASE_URL}/photos/${photoId}/proxy`
+    const token = localStorage.getItem('access_token')
+    const qs = token ? `?token=${encodeURIComponent(token)}` : ''
+    return `${API_BASE_URL}/photos/${photoId}/proxy${qs}`
   },
 
   /** "On this day" memories — photos taken on this date in previous years. */