sidecar: scoped photos/timeline proxy (fixes review + archive leak)

- New GET /api/sidecar/timeline — proxies PP's /api/v1/photos and
  post-filters by FileName prefix matching the user's BasePath
- Also works for review/archive views (q=review:true, q=archived:true)
- Frontend route uses /timeline to avoid Gin route conflict with
  existing /photos/:uid/marks pattern

sidecar/main.go

@@ -98,12 +98,16 @@ func main() {
 			auth.GET("/duplicates/scan", handleDupScan(cfg, pp))
 			auth.POST("/duplicates/archive", handleDupArchive(cfg, pp))
 
-			// User-scoped proxies — require PpDSN connection.
-			if ppDb != nil {
-				auth.GET("/labels", handleLabels(pp, ppDb))
-				auth.GET("/counts", handleScopedCounts(ppDb))
-			}
-		}
+						// User-scoped proxies — require PpDSN connection.
+						if ppDb != nil {
+							auth.GET("/labels", handleLabels(pp, ppDb))
+							auth.GET("/counts", handleScopedCounts(ppDb))
+						}
+
+						// User-scoped photos — post-filters by BasePath so review/archive
+						// tabs only show photos the user owns.
+						auth.GET("/timeline", handlePhotos(pp))
+					}
 
 	addr := cfg.ListenAddr + ":" + itoa(cfg.Port)
 	srv := &http.Server{