photos, extracted from the platform into its own repository

The fifth plugin out, and the cheapest so far — offscale's shape rather than
music's or vault's. Nothing stayed behind and nothing had to be redesigned,
for three structural reasons recorded in PLUGIN.md:

  • No reverse dependency. Nothing in src/ imported anything of photos'.
  • Configuration was already right. The URL and API key live in photos_config,
    a per-user registry encrypted at rest and driven from the app. Vault had to
    move VAULTWARDEN_URL out of .env and invent a settings panel; here the
    sidecar already read the database, and its own comment already said why
    nothing reads process.env.
  • The frontend was already panels. The screen was a WorkspaceView around
    exactly photos-nav and photos-view, so web/panels.ts and web/layout.ts are
    the screen's contents with the wrapper removed.

The router's prefix is now derived from mountPrefix rather than the literal
'/api/photos', which was correct only by coincidence — a third-party publisher
mounts at /api/p/<publisher>/photos and the literal would forward the wrong
path to the sidecar.

Palette debt paid down as the runbook requires: 6 classes (it says 47; someone
had already done most of it), all of them state colours wearing palette
numbers, now `success` and `warning` from the closed tone set so they follow
the theme.

Immich itself is still provisioned by the app store rather than by this plugin
— the `provisioned` half of its old catalogue entry has no home until Docker
provisioning for plugins exists. Point it at an instance you already run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -0,0 +1,40 @@
+# Photos
+
+Your Immich library, reached through Officer.
+
+Photos does not store photographs and does not install Immich. You point it at an instance you already
+run; it forwards to it and holds the API key server-side, so no device ever carries one. Your library,
+your originals and every thumbnail stay exactly where they are.
+
+## What you get
+
+- **The whole library** — timeline, albums, people, places, sharing and search, as panels inside Officer.
+- **A map** of everything with coordinates, clustered.
+- **Upload from the phone**, through Officer rather than to Immich directly.
+- **More than one instance.** Accounts are a per-user registry with a label, a URL and a key; one is
+  active and you switch between them in the app.
+
+## What you need
+
+**An Immich you already run**, and an API key from it (Immich → Account Settings → API Keys).
+
+Create the key with **all permissions**. A scoped key returns 403 per route, which does not read as a
+permissions problem — it reads as a broken feature, one screen at a time.
+
+Nothing else. No system packages, no host binaries.
+
+## Setup
+
+1. Install the plugin.
+2. Open **/photos → Connection** and add an instance: a label, its URL, and the API key.
+3. It probes the server, records its version, and marks the account active.
+
+## What it deliberately does not do yet
+
+- **It is a client, not a backup.** Nothing is copied to Officer. If your Immich goes away, so does the
+  library — this plugin never held it.
+- **The key is write-only across the boundary.** The account list reports label, URL and which is active,
+  and has no field that could carry a key, masked or otherwise. The only way to change one is to replace
+  it. That is deliberate, and it means the app cannot show you a key you have forgotten.
+- **Editing lives in Immich.** This browses, searches, uploads and organises into albums; it is not a
+  photo editor and will not become one.