Revocable per-photo share links with a random token

Summary

Give individual photos a revocable share link with a random per-share token, the way user albums have one after #2019.

Follow-up from #2019 (fixes #76). That PR makes a user album's public slug rotate when the share is revoked. The per-photo "Make public and copy link" action in the lightbox was left alone because it needs a new model rather than a fix.

Current behaviour

The lightbox copies <server>/media/thumbnails_big/<image_hash>. The URL is derived from the file content, so it is the same forever and cannot be rotated or withdrawn without deleting the photo. It also does not work for anonymous visitors on current dev (tracked separately).

Proposed design

• New model, for example PhotoShare(photo FK, slug random 12 hex chars, enabled bool, created_at), with a migration.
• Endpoints: create/rotate/disable a share for a photo the caller owns, and a public view GET /api/public/photo/<slug>/ that serves the photo metadata and media through the existing derived-media access check (which should accept an active photo share the same way it accepts an active album share).
• Frontend: the lightbox "Make public and copy link" action creates a share and copies /public/p/<slug>; the sharing panel lists active photo shares with rotate and revoke buttons, mirroring AlbumSlugSection.
• Revoking clears the slug so a new share mints a fresh one, consistent with #2019.

Out of scope

• Expiring links and password protected links, which could build on the same model later.