feat(sidecar): scoped PhotoPrism-compatible API proxy for third-party apps

PhotoPrism CE doesn't enforce auth_users.base_path on API reads (any
user can q=path:"other/*"). New /api/v1/* proxy forwards to PhotoPrism
with per-session enforcement: search queries get their path filter
validated/injected, single-photo reads and like are ownership-checked,
hash-addressed media and session/config pass through, everything else
is 403 for scoped users. Admins (empty BasePath) pass through fully.
prism.hubris.network will route here instead of straight to PhotoPrism.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sidecar/main.go

@@ -123,6 +123,11 @@ func main() {
 									auth.GET("/folders", handleFoldersProxy(pp))
 					}
 
+	// PhotoPrism-compatible scoped proxy — the public surface for third-
+	// party PhotoPrism apps (prism.hubris.network routes here instead of
+	// straight to PhotoPrism). See handlers_ppproxy.go for the rules.
+	r.Any("/api/v1/*rest", handlePPProxy(cfg))
+
 	addr := cfg.ListenAddr + ":" + itoa(cfg.Port)
 	srv := &http.Server{
 		Addr:              addr,