photos, extracted from the platform into its own repository

The fifth plugin out, and the cheapest so far — offscale's shape rather than
music's or vault's. Nothing stayed behind and nothing had to be redesigned,
for three structural reasons recorded in PLUGIN.md:

  • No reverse dependency. Nothing in src/ imported anything of photos'.
  • Configuration was already right. The URL and API key live in photos_config,
    a per-user registry encrypted at rest and driven from the app. Vault had to
    move VAULTWARDEN_URL out of .env and invent a settings panel; here the
    sidecar already read the database, and its own comment already said why
    nothing reads process.env.
  • The frontend was already panels. The screen was a WorkspaceView around
    exactly photos-nav and photos-view, so web/panels.ts and web/layout.ts are
    the screen's contents with the wrapper removed.

The router's prefix is now derived from mountPrefix rather than the literal
'/api/photos', which was correct only by coincidence — a third-party publisher
mounts at /api/p/<publisher>/photos and the literal would forward the wrong
path to the sidecar.

Palette debt paid down as the runbook requires: 6 classes (it says 47; someone
had already done most of it), all of them state colours wearing palette
numbers, now `success` and `warning` from the closed tone set so they follow
the theme.

Immich itself is still provisioned by the app store rather than by this plugin
— the `provisioned` half of its old catalogue entry has no home until Docker
provisioning for plugins exists. Point it at an instance you already run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

manifest.ts

@@ -0,0 +1,39 @@
+import type { PluginManifest } from '@@/plugins/manifest';
+
+/**
+ * Photos — your Immich library, reached through Officer.
+ *
+ * ── What this plugin is, and what it is not ──
+ *
+ * It does NOT store photographs, and it does not install Immich. You point it at an instance you already
+ * run and it forwards to it, holding the API key server-side so no device ever carries one. The library,
+ * the originals and every thumbnail stay where they are.
+ *
+ * The account registry is per-user and already server-side (`photos_config`): a label, a URL and an
+ * encrypted API key, with one marked active. Adding and switching instances happens in the app rather
+ * than in a shell, which is why nothing here reads `process.env` — an `IMMICH_API_KEY` in `.env` would
+ * also sit in the environment of every other pm2 process, including the one with the largest attack
+ * surface and no code to use it.
+ *
+ * ── No `osDependencies` ──
+ *
+ * Nothing shells out. The sidecar is a Bun HTTP proxy and reaches Immich with `fetch`.
+ */
+export const manifest: PluginManifest = {
+  publisher: 'officerdev',
+  version: '1.0.0',
+  platform: '>=1.0.0',
+
+  label: 'Photos',
+  summary: 'Your Immich library — browse, search, upload from the phone',
+  icon: 'Images',
+  color: '#10b981',
+
+  permissions: [
+    {
+      key: 'photos',
+      label: 'Photos',
+      description: 'Browse the photo library',
+    },
+  ],
+};