Add curator authentication with audit logging and fix empty 3D gallery sessions.

Introduce session-based curator login, gate debug/checkup routes, log mutations to curator_audit_log, and keep guest hall preload public. Fix gallery view mounting so WebGL halls render reliably after navigation.

infra/docker/.env.prod.example

@@ -12,3 +12,8 @@ HOST=0.0.0.0
 PUBLIC_URL=https://gallery.mysuperlab.netcraze.pro
 TRUST_PROXY=true
 IMAGE_DIR=/app/data/images
+
+SESSION_SECRET=change-me-to-a-long-random-string
+SESSION_COOKIE_SECURE=true
+CURATOR_USERNAME=curator
+CURATOR_PASSWORD=

infra/docker/compose.truenas.yaml

@@ -28,6 +28,10 @@ services:
       PUBLIC_URL: https://gallery.mysuperlab.netcraze.pro
       TRUST_PROXY: "true"
       IMAGE_DIR: /app/data/images
+      SESSION_SECRET: "REPLACE_WITH_LONG_RANDOM_SECRET"
+      SESSION_COOKIE_SECURE: "true"
+      CURATOR_USERNAME: curator
+      CURATOR_PASSWORD: "REPLACE_WITH_SECURE_PASSWORD"
     volumes:
       - /mnt/BasePool/Applications/Gallery/data/images:/app/data/images
     extra_hosts: