NPMplus proxy strips the Authorization header before it reaches the backend,
causing all write operations to return 401. Switch to a custom X-Admin-Password
header which passes through the proxy unmodified.
- backend/routes/photos.js: requireAuth checks X-Admin-Password first, falls
back to Authorization Bearer for compatibility
- backend/server.js: add X-Admin-Password to CORS allowedHeaders
- admin/admin.js: send X-Admin-Password instead of Authorization Bearer
in all fetch calls and XHR upload requests
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
chris
1a1fe7044a