fix(web): exclude large-upload route from auth middleware (10MB body cap)

The real cause of the failed 584MB album upload: Next.js caps the request body
at 10MB for any route that passes through middleware, and the import route went
through the auth gate. Exclude /api/library/import from the middleware matcher so
the body streams uncapped to busboy, and authenticate it inline instead (new
lib/auth.isAuthed reads + verifies the session cookie from the request).

web 161 tests, tsc + build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/lib/auth.ts

@@ -37,6 +37,16 @@ export async function expectedToken(): Promise<string> {
   return token;
 }
 
+/** Authenticate a request directly (for routes excluded from the auth middleware, e.g. large
+ *  uploads). Returns true when auth is disabled or the request carries a valid session cookie. */
+export async function isAuthed(request: Request): Promise<boolean> {
+  const token = await expectedToken();
+  if (!token) return true; // auth disabled
+  const cookie = request.headers.get("cookie") ?? "";
+  const m = cookie.match(new RegExp(`(?:^|;\\s*)${AUTH_COOKIE}=([^;]+)`));
+  return safeEqual(m ? decodeURIComponent(m[1]) : "", token);
+}
+
 /** Constant-time string compare (both operands are our own derived tokens). */
 export function safeEqual(a: string, b: string): boolean {
   if (a.length !== b.length) return false;