Add a /manage page to edit, delete and restore posts

A new auth-gated web UI at /manage lists every post for inline editing of
caption, date and tags, with per-row and bulk delete and bulk tag add/remove.
It is backed by a small JSON API (all behind the same htpasswd Basic auth as
/upload, and unlinked from the public site):

  GET  /api/photos        list posts (newest first)
  POST /api/edit          rewrite one sidecar (caption, date, tags)
  POST /api/tags          bulk add/remove tags across posts
  POST /api/delete        move posts to content/.trash/ (reversible)
  GET  /api/trash         list trashed items
  POST /api/restore       move a trashed item back (409 on live-slug clash)
  POST /api/trash/empty   hard delete trashed items (id… or all=1)

Design notes:
- Editing only rewrites the .toml; the slug (and URL) never changes.
- Delete is reversible: image + sidecar move to content/.trash/ with a
  timestamp suffix, excluded from the site (loadPhotos skips dirs). The only
  hard delete is emptying the trash.
- Build now prunes: it drops the derived HTML trees (photo/ day/ album/ page/
  grid/page/) and regenerates them, and pruneRenditions removes orphaned
  images/thumbs/medium/og. Without this a deleted post would linger at its old
  URL and on stale day/album pages; this also cleans up after a hand-removed
  sidecar.
- Sidecars are written atomically (temp + rename) so a concurrent build never
  observes a half-written file.
- Slugs and trash ids are validated as bare filenames, closing path traversal
  and dotfile access.
- Every state-changing POST passes a sameOrigin (CSRF) check, since Basic-auth
  credentials are replayed by the browser on every request to the host. It
  honours Sec-Fetch-Site, falls back to Origin vs base-url/Host, and allows
  header-less non-browser clients. Ported from the independent /manage on
  plex/trunk-ng.

module.nix proxies /manage and /api/ to the app (nginx otherwise serves them
as missing static files). The apps are unchanged; the API is there for them to
adopt edit/delete later.

module.nix

@@ -194,11 +194,22 @@ in {
           };
 
           # Auth is handled by the app (see services.photogallery.htpasswdFile),
-          # so nginx just proxies the upload endpoint.
+          # so nginx just proxies the dynamic endpoints: the upload form/API,
+          # the manage (edit/delete) page and its JSON API. Everything else is
+          # the static site served from root above.
           locations."/upload" = {
             proxyPass   = "http://127.0.0.1:${toString cfg.port}";
             extraConfig = "client_max_body_size 20M;";
           };
+
+          locations."/manage" = {
+            proxyPass = "http://127.0.0.1:${toString cfg.port}";
+          };
+
+          locations."/api/" = {
+            proxyPass   = "http://127.0.0.1:${toString cfg.port}";
+            extraConfig = "client_max_body_size 20M;";
+          };
         };
       };
     })