История коммитов

Move the vote action to POST /album/photo/{img}/vote/{type} with CSRF.

- Add VoteType enum, EnsureVoteAccessUseCase (can_vote policy),
GetVotePhotoContextUseCase, VotePhotoUseCase and VotePhotoController.
- Add vote repository methods (hasUserVote/addVote) and atomic
vote counter increments on the photo repository.
- Update PhotoPresenter vote URLs and convert vote links to inline
POST forms in top/show/show_one templates.
- Remove legacy includes/vote.php and drop it from the dispatcher.

Add DeletePhotoController (GET confirm + POST submit) with CSRF token
validation, GetDeletePhotoContextUseCase guard (owner / rights>=6) and
DeletePhotoUseCase cascading file/vote/comment removal.

New route POST/GET /album/photo/{img}/delete replaces legacy
?act=image_delete; remove includes/image_delete.php and the legacy
image_delete.phtml template (reuse generic confirm_delete.phtml).

Add MovePhotoController (GET album picker + POST submit) with
GetMovePhotoContextUseCase guard (owner or rights>=6) and MovePhotoUseCase
validating the target album belongs to the photo owner and moving the photo
(inheriting the target album's access). New repository helpers
getUserAlbumsExcept and moveToAlbum. New routes GET+POST
/album/photo/{img}/move; drop the image_move action from the legacy dispatcher
and point the photo move link to the new URL.

Add EditPhotoController (GET form + POST save) with GetEditPhotoContextUseCase
guard (owner or rights>=6) and EditPhotoUseCase updating the description
(<=1500 chars) through AlbumPhotoRepository::updateDescription. New routes
GET+POST /album/photo/{img}/edit; drop the image_edit action from the legacy
dispatcher and point the photo edit link to the new URL.

Add UploadPhotoController (GET form + POST submit) with
GetUploadPhotoContextUseCase guard (owner not banned or rights>=7) and
UploadPhotoUseCase processing the image via Intervention ImageManager
(1920x1080 original + 400x300 blurred-backdrop thumbnail, 1:1 with legacy) and
persisting it through AlbumPhotoRepository::create. New routes
GET+POST /album/{al}/upload; drop the image_upload action from the legacy
dispatcher and point the album view upload button to the new URL.

Add SortAlbumController (move-up/move-down) with GetSortAlbumContextUseCase
guard (owner or rights>=7) and MoveAlbumUseCase swapping the sort value with
the neighbouring album. Convert the legacy GET action to POST routes
/album/{al}/move-up and /album/{al}/move-down protected by csrf_token; render
the list Up/Down controls as inline POST forms. Drop the sort action from the
legacy dispatcher.

Add DeleteAlbumController (GET confirmation + POST submit) with
GetDeleteAlbumContextUseCase guard (owner or rights>=6) and DeleteAlbumUseCase
cascading removal of photo files, votes, comments, photos and the album.
Replace the delete_token with the standard csrf_token + Csrf validator. New
routes GET+POST /album/{al}/delete; drop the delete action from the legacy
dispatcher. Add AlbumComment model and comment repository plus delete helpers
on the album/photo/vote repositories.

Add EditAlbumController (create/edit form + save) with GetEditAlbumContextUseCase
guard and SaveAlbumUseCase validation (1:1 with legacy). New routes
GET+POST /album/user/{id}/create and /album/{al}/edit; drop the edit action
from the legacy dispatcher. Escape album form output via $this->e().

Add PhotoCommentsController wrapping Johncms\Comments behind
/album/photo/{img}/comments (capture via ob_start like downloads).
GetPhotoCommentsContextUseCase loads the photo and guards album access;
the controller resets/sets the unread-comments flag via the photo
repository. Remove includes/comments.php.

Add DownloadPhotoController and DownloadPhotoUseCase behind
/album/photo/{img}/download. Reuse EnsureAlbumAccessUseCase with a
configurable bypass-rights level (download keeps the legacy moderator
threshold, show keeps admin). Grow the photo repository with download
counter methods. Remove includes/image_download.php.