Add gallery admin and video media support.

This updates gallery handling to support video playback with generated poster thumbnails, adds authenticated admin upload/delete flows, and improves dev/runtime behavior including reliable thumbnail generation and media-safe response handling.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/internal/middleware/middleware.go

@@ -3,7 +3,9 @@ package middleware
 import (
 	"compress/gzip"
 	"io"
+	"mime"
 	"net/http"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
@@ -21,7 +23,7 @@ func (w *gzipResponseWriter) Write(b []byte) (int, error) {
 // Gzip compresses responses when the client accepts it.
 func Gzip(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if !strings.Contains(r.Header.Get("Accept-Encoding"), "gzip") {
+		if !strings.Contains(r.Header.Get("Accept-Encoding"), "gzip") || shouldSkipGzip(r) {
 			next.ServeHTTP(w, r)
 			return
 		}
@@ -59,3 +61,20 @@ func formatMaxAge(d time.Duration) string {
 	return strconv.Itoa(int(d.Seconds()))
 }
 
+func shouldSkipGzip(r *http.Request) bool {
+	// Range requests must stay byte-accurate for media seeking/playback.
+	if r.Header.Get("Range") != "" {
+		return true
+	}
+
+	ext := strings.ToLower(filepath.Ext(r.URL.Path))
+	if ext == "" {
+		return false
+	}
+
+	ct := mime.TypeByExtension(ext)
+	return strings.HasPrefix(ct, "image/") ||
+		strings.HasPrefix(ct, "video/") ||
+		strings.HasPrefix(ct, "audio/")
+}
+