Add curator authentication with audit logging and fix empty 3D gallery sessions.

Introduce session-based curator login, gate debug/checkup routes, log mutations to curator_audit_log, and keep guest hall preload public. Fix gallery view mounting so WebGL halls render reliably after navigation.

Documentation/environments.md

@@ -90,8 +90,14 @@ npm run db:split-databases
    DB_NAME=gallery_dev
    PORT=3451
    PUBLIC_URL=https://devgallery.mysuperlab.netcraze.pro
+   SESSION_SECRET=your-long-random-secret
+   SESSION_COOKIE_SECURE=false
+   CURATOR_USERNAME=curator
+   CURATOR_PASSWORD=your-secure-password
    ```
 
+   `npm run migrate` creates auth tables and bootstraps the first curator when `users` is empty.
+
 2. Run:
 
    ```powershell
@@ -159,8 +165,10 @@ Use normal PowerShell with `-SkipHosts` if you already added `192.168.10.122 git
 1. **Apps** → **Discover Apps** → **Custom App** → **Install via Docker Compose**
 2. Paste contents of `infra/docker/compose.truenas.yaml` from the repo
 3. Replace `YOUR_POSTGRES_PASSWORD` with the `gallery` user password
-4. **Apps** → **Settings** → register Gitea registry (`gitea.mysuperlab.netcraze.pro`, token with `read:package`)
-5. Deploy → wait for **gallery-web** to show **Running**
+4. Replace `REPLACE_WITH_LONG_RANDOM_SECRET` and `REPLACE_WITH_SECURE_PASSWORD` for `SESSION_SECRET` and `CURATOR_PASSWORD`
+5. **Apps** → **Settings** → register Gitea registry (`gitea.mysuperlab.netcraze.pro`, token with `read:package`)
+6. Deploy → wait for **gallery-web** to show **Running**
+7. Run `npm run migrate` against `gallery_prod` if auth tables are not yet applied (or migrate from dev PC with prod env)
 
 ### Step H — Verify production
 
@@ -171,7 +179,7 @@ curl.exe -sk https://gallery.mysuperlab.netcraze.pro/api/bounds
 curl.exe -s http://192.168.10.122:5173/api/bounds
 ```
 
-Open **https://gallery.mysuperlab.netcraze.pro/** — timeline and sample painting images should load.
+Open **https://gallery.mysuperlab.netcraze.pro/** — timeline and sample painting images should load. Click an artist portrait or movement label to enter a 3D hall. **Curator login** (top-right) unlocks debug mode and Checkup.
 
 ---
 
@@ -223,8 +231,12 @@ Expect **HTTP 200** (not 502).
 ```env
 PUBLIC_URL=https://devgallery.mysuperlab.netcraze.pro
 TRUST_PROXY=true
+SESSION_SECRET=your-long-random-secret
+SESSION_COOKIE_SECURE=false
 ```
 
+Prod (`infra/docker/.env.prod`): set `SESSION_COOKIE_SECURE=true` and the same `SESSION_SECRET` / `CURATOR_*` vars on the TrueNAS app environment.
+
 Restart `npm run dev:web` after changing `PUBLIC_URL`.
 
 ---