feat(api): add S3-backed gallery photos v1

[MehrshadFb]

Summary

Implements the photos v1 architecture (api/docs/photos-architecture.md): photos live in S3, metadata in Postgres, and clients talk to S3 directly via short-lived presigned URLs — the API never proxies image bytes.

What's included

• Photo model reshaped (s3Key, contentType, sizeBytes, PhotoStatus PENDING/READY) with composite list index; kept addedById for attribution
• Photo CASL subject — read: any event member; upload: organizer/participant; delete: organizer any photo, uploader their own
• POST /galleries/:id/photos/upload-urls — batch presigned PUT slots (1h TTL), PENDING rows, contentType/size/batch caps
• POST /galleries/:id/photos/confirm — HeadObject verification, per-photo READY/MISSING/MISMATCHED/NOT_FOUND, idempotent
• GET /galleries/:id/photos — cursor-paginated READY photos, newest first, 15m presigned GET URLs
• GET /photos/:id + DELETE /photos/:id — detail view and retry-safe delete (S3 object first, row second)
• S3Service.headObject; AbilityFactory.createForCaller adopted (from refactor(api): centralize caller ability creation in AbilityFactory #29)
• 50 unit tests + 26 e2e tests; OpenAPI + mobile client regenerated

Not in this PR (intentional)

• PENDING-row cleanup sweeper, quotas, thumbnails, CloudFront, SSE-KMS bucket config — tracked as deferred work in the architecture doc

Test plan

• CI green: format:check, eslint, openapi:check, npm test (265), test:e2e (101), build