feat: photo/video capture-date pipeline + premium UI/UX overhaul

Backend — Photos timeline now groups by real capture date instead of upload time. New MediaMetadataService (FileLifecycleHook) extracts EXIF DateTimeOriginal from images and container creation_time from videos (mov/mp4/mkv) via nom-exif, timezone-correct (OffsetTimeOriginal), persisting captured_at so the existing media_sort_date trigger takes over. Adds POST /admin/photos/metadata/reextract to backfill existing media. Falls back to upload date when no embedded date exists.

Frontend — premium grid cards: combined metadata line (relative date · size, owner avatar when shared), custom selection checkbox with a clear checked state, uniform full-width 4:3 thumbnail tiles independent of filename length, centered file-type icons, and a hit-test fix so checkbox/star/kebab clicks reach the controls (the decorative thumbnail no longer captures pointer events). Notification messages internationalised across all 16 locales. Broader polish: design tokens, a11y/focus-visible states, brand + PWA assets.

Chore — bump semver-compatible dependencies (cargo upgrade); add nom-exif 3.6.1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/check-dead-tokens.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+// Dead-token report (informational, exit 0): design tokens defined in
+// variables.css but never referenced via var() anywhere in static/.
+//
+// NOTE: a cleanup AID, not a hard gate — some tokens (file-type / calendar
+// colours) are referenced by JS string construction, so excluded prefixes are
+// skipped to avoid false positives. Verify before pruning.
+//
+//   node scripts/check-dead-tokens.mjs
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..', 'static');
+const EXCLUDE_PREFIX = ['--color-ft-', '--color-cal-']; // referenced dynamically from JS
+
+const varsSrc = readFileSync(join(root, 'css', 'base', 'variables.css'), 'utf8');
+const defined = [...varsSrc.matchAll(/(--[a-z0-9-]+)\s*:/gi)].map((m) => m[1]);
+
+function walk(dir, files = []) {
+    for (const name of readdirSync(dir)) {
+        const p = join(dir, name);
+        if (statSync(p).isDirectory()) walk(p, files);
+        else if (/\.(css|js|html|webmanifest)$/.test(name)) files.push(p);
+    }
+    return files;
+}
+let corpus = '';
+for (const f of walk(root)) corpus += readFileSync(f, 'utf8');
+const used = new Set([...corpus.matchAll(/var\(\s*(--[a-z0-9-]+)/gi)].map((m) => m[1]));
+
+const dead = defined
+    .filter((t) => !used.has(t))
+    .filter((t) => !EXCLUDE_PREFIX.some((p) => t.startsWith(p)))
+    .sort();
+
+if (dead.length) {
+    console.log(`Dead-token candidates (defined, never referenced via var()): ${dead.length}`);
+    console.log('  ' + dead.join('\n  '));
+    console.log('\n(Verify each before pruning — some may be referenced dynamically.)');
+} else {
+    console.log('✓ No dead-token candidates.');
+}