feat(hobbs-organizer): v1.2.0 photo frame (/photo) with Google Photos shared albums

- /photo full-screen slideshow (crossfade, blurred backdrop or fill, shuffle, date)
- admin Photos tab: add shared-album links (check, sync now, status/stale warnings),
  slideshow options, browser-resized uploads
- 6-hourly album sync scraping the share page (Library API no longer exposes
  user albums), caches 1920px + 64px copies in /data/photos
- /api/health/photos -> 503 when an album has not synced for 48h
- history/restore covers photo settings; min admin password length 6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3

tv app/Hobbs-Family-Organizer-Self-Hosted-v1.0.0/app/_lib/store.ts

@@ -16,12 +16,86 @@ export type CalendarSetting = {
   enabled: boolean;
 };
 
+export type PhotoAlbum = {
+  id: string;
+  /** Display name override; empty means "use the album's own title". */
+  name: string;
+  shareUrl: string;
+  enabled: boolean;
+};
+
+export type PhotoDisplay = {
+  intervalSeconds: number;
+  shuffle: boolean;
+  showDate: boolean;
+  fit: "contain-blur" | "cover";
+  includeUploads: boolean;
+};
+
+export type PhotoSettings = PhotoDisplay & { albums: PhotoAlbum[] };
+
+export const MAX_ALBUMS = 10;
+export const DEFAULT_PHOTO_SETTINGS: PhotoSettings = {
+  intervalSeconds: 20,
+  shuffle: true,
+  showDate: true,
+  fit: "contain-blur",
+  includeUploads: true,
+  albums: [],
+};
+
 export type Settings = {
   schema: 1;
   updatedAt: string;
   calendars: CalendarSetting[];
+  photos: PhotoSettings;
 };
 
+/** Accepts photos.app.goo.gl short links and photos.google.com/share links. */
+export function validAlbumUrl(value: unknown) {
+  let url: URL;
+  try {
+    url = new URL(String(value).trim());
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:") return null;
+  if (url.hostname === "photos.app.goo.gl" && /^\/[A-Za-z0-9_-]{6,64}$/.test(url.pathname)) return `https://photos.app.goo.gl${url.pathname}`;
+  if (url.hostname === "photos.google.com" && /^\/share\/[A-Za-z0-9_-]{10,200}$/.test(url.pathname)) return url.toString();
+  return null;
+}
+
+export function maskAlbumUrl(url: string) {
+  const parsed = new URL(url);
+  const id = parsed.pathname.split("/").pop() || "";
+  return `${parsed.hostname}/…${id.slice(-4)}`;
+}
+
+function normalizePhotos(raw: unknown): PhotoSettings {
+  const value = (raw ?? {}) as Partial<PhotoSettings>;
+  const interval = Number(value.intervalSeconds);
+  return {
+    intervalSeconds: Number.isFinite(interval) ? Math.min(3600, Math.max(5, Math.round(interval))) : DEFAULT_PHOTO_SETTINGS.intervalSeconds,
+    shuffle: value.shuffle !== false,
+    showDate: value.showDate !== false,
+    fit: value.fit === "cover" ? "cover" : "contain-blur",
+    includeUploads: value.includeUploads !== false,
+    albums: (Array.isArray(value.albums) ? value.albums : [])
+      .map((entry) => {
+        const shareUrl = validAlbumUrl(entry?.shareUrl);
+        if (!shareUrl) return null;
+        return {
+          id: typeof entry.id === "string" && /^[A-Za-z0-9-]{8,64}$/.test(entry.id) ? entry.id : randomUUID(),
+          name: typeof entry.name === "string" ? entry.name.trim().slice(0, 60) : "",
+          shareUrl,
+          enabled: entry.enabled !== false,
+        } satisfies PhotoAlbum;
+      })
+      .filter((entry): entry is PhotoAlbum => entry !== null)
+      .slice(0, MAX_ALBUMS),
+  };
+}
+
 export type AuthState = {
   passwordHash: string;
   sessionSecret: string;
@@ -74,6 +148,7 @@ function normalizeSettings(raw: unknown): Settings {
       })
       .filter((entry): entry is CalendarSetting => entry !== null)
       .slice(0, MAX_CALENDARS),
+    photos: normalizePhotos(value.photos),
   };
 }
 
@@ -103,7 +178,7 @@ export async function readSettings(): Promise<Settings> {
   }
 }
 
-export type HistoryEntry = { id: string; savedAt: string; calendarCount: number; note: string };
+export type HistoryEntry = { id: string; savedAt: string; calendarCount: number; albumCount: number; note: string };
 
 async function pruneHistory() {
   const files = (await readdir(historyDir())).filter((name) => name.endsWith(".json")).sort();
@@ -112,15 +187,17 @@ async function pruneHistory() {
   }
 }
 
-/** Saves new settings, first snapshotting the current ones into history. */
-export function saveSettings(calendars: CalendarSetting[], note: string) {
+/** Saves new settings (only the parts given), first snapshotting the current ones into history. */
+export function saveSettings(patch: Partial<Pick<Settings, "calendars" | "photos">>, note: string) {
   return serialized(async () => {
     const current = await readSettings();
+    const calendars = patch.calendars ?? current.calendars;
+    const photos = patch.photos ?? current.photos;
     const stamp = new Date().toISOString();
     const snapshotId = `${stamp.replace(/[:.]/g, "-")}`;
     await writeJsonAtomic(path.join(historyDir(), `${snapshotId}.json`), { ...current, note });
     await pruneHistory();
-    const next = normalizeSettings({ schema: 1, updatedAt: stamp, calendars });
+    const next = normalizeSettings({ schema: 1, updatedAt: stamp, calendars, photos });
     await writeJsonAtomic(settingsPath(), next);
     return next;
   });
@@ -136,6 +213,7 @@ export async function listHistory(): Promise<HistoryEntry[]> {
         id: name.slice(0, -5),
         savedAt: raw.updatedAt,
         calendarCount: Array.isArray(raw.calendars) ? raw.calendars.length : 0,
+        albumCount: Array.isArray(raw.photos?.albums) ? raw.photos.albums.length : 0,
         note: typeof raw.note === "string" ? raw.note : "",
       });
     } catch {