Fix Android manage thumbnails and multi-select picker

Thumbnails were blank on the manage screen because the app fetched them from
the static /thumbs/ path, which a front-door botwall on `location /` blocks for
a non-browser client even though /api/ (proxied to the app) works. Add an authed
GET /api/thumb/{slug} that serves the thumbnail JPEG from public/thumbs/, and
have the app fetch from there. Also show the thumbnail in the edit dialog, not
just the list rows.

Construct the photo picker with an explicit maxItems so it reliably opens in
multi-select mode; the no-arg PickMultipleVisualMedia default has been seen to
present single-select on some devices.

manage.go

@@ -59,6 +59,32 @@ func (s *Server) handleSession(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, map[string]bool{"authenticated": false})
 }
 
+// handleThumb serves a photo's thumbnail from the generated output, behind the
+// same Basic auth as the rest of /api/. Non-browser clients (the Android app)
+// use this instead of the static /thumbs/<slug>.jpg path, because a front-door
+// botwall on `location /` can block a non-browser client from the static site
+// while `/api/` is proxied straight to this server.
+func (s *Server) handleThumb(w http.ResponseWriter, r *http.Request) {
+	slug := r.PathValue("slug")
+	if slug == "" || slug != filepath.Base(slug) || strings.HasPrefix(slug, ".") {
+		http.Error(w, "bad slug", http.StatusBadRequest)
+		return
+	}
+	f, err := os.Open(filepath.Join(s.outputDir, "thumbs", slug+".jpg"))
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	defer f.Close()
+	fi, err := f.Stat()
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", "image/jpeg")
+	http.ServeContent(w, r, slug+".jpg", fi.ModTime(), f)
+}
+
 // handleManagePage serves the (auth-gated) edit/delete UI.
 func (s *Server) handleManagePage(w http.ResponseWriter, r *http.Request) {
 	data, err := assets.ReadFile("templates/manage.html")