Add curator authentication with audit logging and fix empty 3D gallery sessions.

Introduce session-based curator login, gate debug/checkup routes, log mutations to curator_audit_log, and keep guest hall preload public. Fix gallery view mounting so WebGL halls render reliably after navigation.

server/migrate.js

@@ -9,8 +9,32 @@ const INCREMENTAL_MIGRATIONS = [
   'migrate-influence-sources.sql',
   'migrate-painting-annotations.sql',
   'migrate-artist-palette.sql',
+  'migrate-auth.sql',
 ];
 
+async function bootstrapCurator() {
+  const { rows } = await pool.query('SELECT COUNT(*)::int AS n FROM users');
+  if (rows[0].n > 0) {
+    console.log('  curator bootstrap: users table already populated');
+    return;
+  }
+
+  const username = (process.env.CURATOR_USERNAME || 'curator').trim();
+  const password = process.env.CURATOR_PASSWORD;
+  if (!password) {
+    console.warn('  curator bootstrap skipped: set CURATOR_PASSWORD to create the first curator account');
+    return;
+  }
+
+  const bcrypt = require('bcryptjs');
+  const passwordHash = await bcrypt.hash(password, 10);
+  await pool.query(
+    `INSERT INTO users (username, password_hash) VALUES ($1, $2)`,
+    [username, passwordHash]
+  );
+  console.log(`  bootstrap curator account: ${username}`);
+}
+
 async function applySqlFile(label, filePath) {
   const sql = fs.readFileSync(filePath, 'utf8');
   await pool.query(sql);
@@ -34,6 +58,9 @@ async function migrate() {
     await applySqlFile(file, filePath);
   }
 
+  console.log('Bootstrapping curator account (if needed) …');
+  await bootstrapCurator();
+
   console.log('Database migration complete.');
 }