Add admin panel, gallery, and security hardening.

Replace forgeable cookie auth with signed JWT sessions, protect admin APIs, add input validation, and improve Docker deployment config.

prisma/schema.prisma

@@ -0,0 +1,21 @@
+generator client {
+  provider      = "prisma-client-js"
+  binaryTargets = ["native", "debian-openssl-1.1.x", "debian-openssl-3.0.x"]
+}
+
+datasource db {
+  provider = "sqlite"
+  url      = env("DATABASE_URL")
+}
+
+model Location {
+  id            String   @id @default(uuid())
+  title         String
+  city          String
+  tags          String
+  captureDate   DateTime
+  visibility    String   @default("public") // 'public' or 'unlisted'
+  gpxData       String?
+  createdAt     DateTime @default(now())
+  updatedAt     DateTime @updatedAt
+}