fix: all users get subfolders, nobody owns the mount root

Every user — including the initial admin — now gets their own
subdirectory under PHOTO_DIRS (e.g. /photos/admin, /photos/bob).
No one's source root points to the mount root itself, eliminating
cross-user photo overlap entirely.

- Setup endpoint: admin gets /photos/{username} like everyone else
- Migration: default admin media_path set to /photos/admin
- Remove scan directory pruning (no longer needed)
- Fix thumbnail retry URL: use & separator when token query param
  already present (was producing ?token=...?retry=N)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/alembic/versions/0009_users_and_auth.py

@@ -80,7 +80,7 @@ def upgrade() -> None:
         pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
         hashed = pwd_context.hash(generated_password)
 
-        # The default admin's media_path is the legacy /photos root
+        # Every user gets a subfolder — including the migrated admin.
         conn.execute(
             sa.text(
                 "INSERT INTO users (id, username, hashed_password, role, media_path) "
@@ -91,7 +91,7 @@ def upgrade() -> None:
                 "username": "admin",
                 "hashed": hashed,
                 "role": "admin",
-                "media_path": "/photos",
+                "media_path": "/photos/admin",
             },
         )