Add curator authentication with audit logging and fix empty 3D gallery sessions.

Introduce session-based curator login, gate debug/checkup routes, log mutations to curator_audit_log, and keep guest hall preload public. Fix gallery view mounting so WebGL halls render reliably after navigation.

server/middleware/session.js

@@ -0,0 +1,38 @@
+const session = require('express-session');
+const pgSession = require('connect-pg-simple')(session);
+const pool = require('../db');
+
+const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
+
+function createSessionMiddleware() {
+  const secret = process.env.SESSION_SECRET;
+  if (!secret) {
+    console.warn(
+      'SESSION_SECRET is not set — using insecure default (set SESSION_SECRET in production)'
+    );
+  }
+
+  const secureCookie =
+    process.env.SESSION_COOKIE_SECURE === '1' ||
+    process.env.SESSION_COOKIE_SECURE === 'true';
+
+  return session({
+    store: new pgSession({
+      pool,
+      tableName: 'session',
+      createTableIfMissing: false,
+    }),
+    name: 'gallery.sid',
+    secret: secret || 'gallery-dev-insecure-session-secret',
+    resave: false,
+    saveUninitialized: false,
+    cookie: {
+      httpOnly: true,
+      secure: secureCookie,
+      sameSite: 'lax',
+      maxAge: SEVEN_DAYS_MS,
+    },
+  });
+}
+
+module.exports = { createSessionMiddleware };