sidecar: scoped labels + counts proxy (fixes cross-user label leak)

- New GET /api/sidecar/labels — proxies PP's labels, recalculates
  PhotoCount per user's BasePath via DB query
- New GET /api/sidecar/counts — returns user-scoped sidebar badges
  (all, review, archived, private, photos, videos, favorites)
- Fixed auth middleware to expose userUID and basePath on context
- Fixed ppClient.resolveSession — uses correct endpoint
  (GET /api/v1/session, not /api/v1/session/{token}) and correct
  JSON field names (UID, Name instead of UserUID, UserName)
- Frontend: listLabels now calls /api/sidecar/labels instead of /api/v1/labels

sidecar/pp.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"io"
+	"log/slog"
 	"net/http"
 	"net/url"
 	"time"
@@ -87,8 +88,8 @@ func (c *ppClient) call(ctx context.Context, method, urlPath, token string, body
 
 // ppSessionUser is the subset of PhotoPrism's session response we need.
 type ppSessionUser struct {
-	UserName string `json:"UserName"`
-	UserUID  string `json:"UserUID"`
+	UserUID  string `json:"UID"`
+	UserName string `json:"Name"`
 	BasePath string `json:"BasePath"`
 }
 
@@ -102,15 +103,22 @@ func (c *ppClient) resolveSession(ctx context.Context, token string) *ppSessionU
 	if token == "" {
 		return nil
 	}
-	r, err := c.call(ctx, http.MethodGet, "/api/v1/session/"+token, token, nil)
-	if err != nil || !r.OK {
+	r, err := c.call(ctx, http.MethodGet, "/api/v1/session", token, nil)
+	if err != nil {
+		slog.Warn("resolveSession: call failed", "err", err)
+		return nil
+	}
+	if !r.OK {
+		slog.Warn("resolveSession: not OK", "status", r.Status, "body", string(r.Body[:min(len(r.Body), 200)]))
 		return nil
 	}
 	var resp ppSessionResponse
 	if err := json.Unmarshal(r.Body, &resp); err != nil {
+		slog.Warn("resolveSession: unmarshal failed", "err", err, "body", string(r.Body[:min(len(r.Body), 200)]))
 		return nil
 	}
 	if resp.User.UserName == "" {
+		slog.Warn("resolveSession: empty username", "body", string(r.Body[:min(len(r.Body), 200)]))
 		return nil
 	}
 	return &resp.User