fix: all users get subfolders, nobody owns the mount root

Every user — including the initial admin — now gets their own
subdirectory under PHOTO_DIRS (e.g. /photos/admin, /photos/bob).
No one's source root points to the mount root itself, eliminating
cross-user photo overlap entirely.

- Setup endpoint: admin gets /photos/{username} like everyone else
- Migration: default admin media_path set to /photos/admin
- Remove scan directory pruning (no longer needed)
- Fix thumbnail retry URL: use & separator when token query param
  already present (was producing ?token=...?retry=N)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/routers/auth.py

@@ -161,9 +161,9 @@ async def setup(body: SetupRequest, db: AsyncSession = Depends(get_db)):
     if len(body.password) < 6:
         raise HTTPException(status_code=400, detail="Password must be at least 6 characters")
 
-    # The initial admin owns the entire photo mount root. Regular users
-    # (created later via admin panel) get a subdirectory under it.
-    media_path = settings.photo_dirs
+    # Every user — including the initial admin — gets their own subfolder
+    # under the photo mount root. Nobody owns the root directory itself.
+    media_path = os.path.join(settings.photo_dirs, body.username.strip())
     os.makedirs(media_path, exist_ok=True)
 
     user = User(