Add curator authentication with audit logging and fix empty 3D gallery sessions.

Introduce session-based curator login, gate debug/checkup routes, log mutations to curator_audit_log, and keep guest hall preload public. Fix gallery view mounting so WebGL halls render reliably after navigation.

Documentation/FAC.md

@@ -78,11 +78,47 @@ copy .env.example .env          # edit DB credentials, PUBLIC_URL
 npm install
 cd client; npm install; cd ..
 
-npm run migrate                 # schema + incremental SQL
+npm run migrate                 # schema + incremental SQL (+ auth tables, bootstrap curator)
 npm run setup                   # migrate + seed (fresh empty DB only)
 ```
 
-After clone with existing data/images, skip `setup` if DB already split — use post-seed steps below.
+**Curator auth (after migrate):** set in `.env` before first `npm run migrate` if the DB has no curator yet:
+
+```env
+SESSION_SECRET=your-long-random-secret
+CURATOR_USERNAME=curator
+CURATOR_PASSWORD=your-secure-password
+```
+
+Then open the gallery → **Curator login** (top-right) → use debug mode / Checkup. Mutations are logged in `curator_audit_log` (view in pgAdmin).
+
+**Roles:**
+
+| Role | Access |
+|------|--------|
+| Guest (`user`) | Timeline, movement flow, 3D halls, painting detail, bios |
+| Curator | Above + debug mode, Checkup, image fix/upload/delete APIs |
+
+**Audit log (pgAdmin on `gallery_dev` or `gallery_prod`):**
+
+```sql
+SELECT l.created_at, u.username, l.action, l.resource_type, l.resource_id
+FROM curator_audit_log l
+JOIN users u ON u.id = l.user_id
+ORDER BY l.created_at DESC
+LIMIT 30;
+```
+
+**Prod auth env** (TrueNAS app or `infra/docker/.env.prod`):
+
+```env
+SESSION_SECRET=long-random-secret
+SESSION_COOKIE_SECURE=true
+CURATOR_USERNAME=curator
+CURATOR_PASSWORD=your-secure-password
+```
+
+Run `npm run migrate` against prod DB after first deploy with auth vars set (creates tables + bootstrap curator if `users` is empty).
 
 ---
 
@@ -107,6 +143,10 @@ After clone with existing data/images, skip `setup` if DB already split — use
 DB_NAME=gallery_dev
 PORT=3451
 PUBLIC_URL=https://devgallery.mysuperlab.netcraze.pro
+SESSION_SECRET=your-long-random-secret
+SESSION_COOKIE_SECURE=false
+CURATOR_USERNAME=curator
+CURATOR_PASSWORD=your-secure-password
 ```
 
 ---