Add curator authentication with audit logging and fix empty 3D gallery sessions.

Introduce session-based curator login, gate debug/checkup routes, log mutations to curator_audit_log, and keep guest hall preload public. Fix gallery view mounting so WebGL halls render reliably after navigation.

server/audit-log.js

@@ -0,0 +1,32 @@
+const pool = require('./db');
+
+function clientIp(req) {
+  const forwarded = req.headers['x-forwarded-for'];
+  if (typeof forwarded === 'string' && forwarded.length > 0) {
+    return forwarded.split(',')[0].trim();
+  }
+  return req.ip || null;
+}
+
+async function logCuratorAction({ userId, action, resourceType, resourceId, details, req }) {
+  if (!userId) return;
+
+  try {
+    await pool.query(
+      `INSERT INTO curator_audit_log (user_id, action, resource_type, resource_id, details, ip_address)
+       VALUES ($1, $2, $3, $4, $5, $6)`,
+      [
+        userId,
+        action,
+        resourceType,
+        resourceId,
+        details ? JSON.stringify(details) : null,
+        req ? clientIp(req) : null,
+      ]
+    );
+  } catch (err) {
+    console.error('Audit log error:', err.message);
+  }
+}
+
+module.exports = { logCuratorAction };