Add curator authentication with audit logging and fix empty 3D gallery sessions.

Introduce session-based curator login, gate debug/checkup routes, log mutations to curator_audit_log, and keep guest hall preload public. Fix gallery view mounting so WebGL halls render reliably after navigation.

.env.example

@@ -14,6 +14,12 @@ TRUST_PROXY=true
 
 IMAGE_DIR=./data/images
 
+# Curator auth (run npm run migrate after setting CURATOR_PASSWORD)
+SESSION_SECRET=change-me-to-a-long-random-string
+SESSION_COOKIE_SECURE=false
+CURATOR_USERNAME=curator
+CURATOR_PASSWORD=
+
 # Production uses infra/docker/.env.prod → gallery_prod at gallery.mysuperlab.netcraze.pro:5173
 # See Documentation/environments.md