Add curator authentication with audit logging and fix empty 3D gallery sessions.

Introduce session-based curator login, gate debug/checkup routes, log mutations to curator_audit_log, and keep guest hall preload public. Fix gallery view mounting so WebGL halls render reliably after navigation.

client/src/context/AuthContext.tsx

@@ -0,0 +1,65 @@
+import { createContext, useCallback, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
+import { getAuthMe, loginCurator, logoutCurator, type AuthRole } from '../api/client';
+
+interface AuthContextValue {
+  role: AuthRole;
+  username?: string;
+  isCurator: boolean;
+  loading: boolean;
+  login: (username: string, password: string) => Promise<void>;
+  logout: () => Promise<void>;
+  refresh: () => Promise<void>;
+}
+
+const AuthContext = createContext<AuthContextValue | null>(null);
+
+export function AuthProvider({ children }: { children: ReactNode }) {
+  const [role, setRole] = useState<AuthRole>('user');
+  const [username, setUsername] = useState<string | undefined>();
+  const [loading, setLoading] = useState(true);
+
+  const refresh = useCallback(async () => {
+    const me = await getAuthMe();
+    setRole(me.role);
+    setUsername(me.username);
+  }, []);
+
+  useEffect(() => {
+    refresh().finally(() => setLoading(false));
+  }, [refresh]);
+
+  const login = useCallback(async (user: string, password: string) => {
+    const me = await loginCurator(user, password);
+    setRole(me.role);
+    setUsername(me.username);
+  }, []);
+
+  const logout = useCallback(async () => {
+    await logoutCurator();
+    setRole('user');
+    setUsername(undefined);
+  }, []);
+
+  const value = useMemo(
+    () => ({
+      role,
+      username,
+      isCurator: role === 'curator',
+      loading,
+      login,
+      logout,
+      refresh,
+    }),
+    [role, username, loading, login, logout, refresh]
+  );
+
+  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
+}
+
+export function useAuth(): AuthContextValue {
+  const ctx = useContext(AuthContext);
+  if (!ctx) {
+    throw new Error('useAuth must be used within AuthProvider');
+  }
+  return ctx;
+}