Add gallery admin and video media support.

This updates gallery handling to support video playback with generated poster thumbnails, adds authenticated admin upload/delete flows, and improves dev/runtime behavior including reliable thumbnail generation and media-safe response handling.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -29,10 +29,19 @@ make dev               # live reload → http://localhost:7331
 
 - Single-page layout: hero, services, gallery, contact
 - Gallery loads via HTMX (`hx-get="/gallery"`)
-- Year filters without full page reload
 - Lightbox modal with previous/next navigation
 - Contact form with SMTP relay (HTMX submit, no page reload)
-- Serves photos from `app/images/`
+- Serves photos from `app/images/` (not in git — mount or copy locally)
+- Password-protected gallery admin at `/admin/`
+
+## Gallery admin
+
+Set both `ADMIN_USER` and `ADMIN_PASSWORD` in `.env`, then open [http://localhost:8080/admin/](http://localhost:8080/admin/) (or via your public URL).
+
+- Sign in with username/password
+- Upload JPEGs into an album (or create a new album folder)
+- Delete images (removes originals and generated thumbs/hero)
+- Changes appear on the public site immediately
 
 ## Contact form (SMTP)
 
@@ -57,7 +66,7 @@ If SMTP is not configured, the page shows a mailto fallback instead of the form.
 
 Only run **`dev`** or **`website`** at a time if you map both to the same host ports.
 
-Production `website` joins the external `caddy` Docker network for reverse proxy labels.
+Production `website` mounts `./app/images` into the container (photos stay on the host). It joins the external `caddy` Docker network for reverse proxy labels.
 
 ## Project layout
 
@@ -79,8 +88,8 @@ docker-compose.yaml
 
 ## Gallery images
 
-On startup the server builds JPEG thumbnails in `app/images/thumbs/` (max 480px edge) for the grid and hero. The lightbox still loads full-resolution originals. Thumbnails are gitignored and regenerated when source photos change.
+On startup the server generates missing derivatives under `app/images/thumbs/` (and `hero/` for JPEGs only). Photos get resized JPEG thumbs; videos (`.mp4`, `.webm`, `.mov`) get a poster frame JPEG via `ffmpeg` when installed. The lightbox plays full videos or shows full-resolution photos. Derivatives are gitignored and rebuilt when source files are newer.
 
 ## Deploy notes
 
-First request after deploy may take a moment while thumbnails are generated if they are not baked into the image yet.
+First request after deploy may take a moment while thumbnails are generated under the mounted `app/images/` directory.