NPMplus proxy strips the Authorization header before it reaches the backend,
causing all write operations to return 401. Switch to a custom X-Admin-Password
header which passes through the proxy unmodified.
- backend/routes/photos.js: requireAuth checks X-Admin-Password first, falls
back to Authorization Bearer for compatibility
- backend/server.js: add X-Admin-Password to CORS allowedHeaders
- admin/admin.js: send X-Admin-Password instead of Authorization Bearer
in all fetch calls and XHR upload requests
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- gallery backend: replace origin whitelist with wildcard CORS — NPMplus
was stripping the Allow-Origin header; wildcard passes through reliably
and is appropriate for a public photo gallery
- gallery.js: hardcode photobackend.beachpartyballoons.com as the API base
(NPMplus already routes this subdomain) and remove dead port fallbacks
- nginx.conf: add /photos and /uploads proxy routes to gallery-backend
(kept for direct-nginx access; NPMplus handles external traffic)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
