Add curator authentication with audit logging and fix empty 3D gallery sessions.

Introduce session-based curator login, gate debug/checkup routes, log mutations to curator_audit_log, and keep guest hall preload public. Fix gallery view mounting so WebGL halls render reliably after navigation.

server/middleware/auth.js

@@ -0,0 +1,27 @@
+const pool = require('../db');
+
+async function requireCurator(req, res, next) {
+  const userId = req.session?.userId;
+  if (!userId) {
+    return res.status(401).json({ error: 'Curator login required' });
+  }
+
+  try {
+    const { rows } = await pool.query(
+      `SELECT id, username FROM users WHERE id = $1`,
+      [userId]
+    );
+    if (rows.length === 0) {
+      req.session.destroy(() => {});
+      return res.status(401).json({ error: 'Curator login required' });
+    }
+
+    req.curatorUser = rows[0];
+    next();
+  } catch (err) {
+    console.error('Auth middleware error:', err.message);
+    res.status(500).json({ error: 'Authentication failed' });
+  }
+}
+
+module.exports = { requireCurator };