Add public curator notes and U-shaped hall wall hang.

Paintings get editable curator notes with brass plates in the 3D hall, and visit order now uses the far/end wall between left and right.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/reset-curator-password.js

@@ -0,0 +1,47 @@
+/**
+ * Upsert the curator account password from .env CURATOR_USERNAME / CURATOR_PASSWORD.
+ * Use when login fails after changing .env, or after a DB restore with a different hash.
+ *
+ *   npm run dev:reset-curator
+ */
+require('dotenv').config();
+const bcrypt = require('bcryptjs');
+const pool = require('../server/db');
+
+async function main() {
+  const username = (process.env.CURATOR_USERNAME || 'curator').trim();
+  const password = process.env.CURATOR_PASSWORD;
+  if (!password) {
+    throw new Error('Set CURATOR_PASSWORD in .env before running this script');
+  }
+
+  const passwordHash = await bcrypt.hash(password, 10);
+  const { rows } = await pool.query(`SELECT id FROM users WHERE LOWER(username) = LOWER($1)`, [
+    username,
+  ]);
+
+  if (rows.length === 0) {
+    await pool.query(`INSERT INTO users (username, password_hash) VALUES ($1, $2)`, [
+      username,
+      passwordHash,
+    ]);
+    console.log(`Created curator account: ${username}`);
+  } else {
+    await pool.query(`UPDATE users SET password_hash = $2 WHERE id = $1`, [
+      rows[0].id,
+      passwordHash,
+    ]);
+    console.log(`Updated password for curator account: ${username}`);
+  }
+
+  // Drop stale sessions so a fresh login is required.
+  await pool.query('DELETE FROM session');
+  console.log('Cleared session store. Sign in again with CURATOR_USERNAME / CURATOR_PASSWORD from .env');
+}
+
+main()
+  .then(() => pool.end())
+  .catch((err) => {
+    console.error(err.message || err);
+    pool.end().finally(() => process.exit(1));
+  });