fix(review-2): critical — repair comment posting + close export data leak

CR1: the lightbox comment button POSTed to /upload/{id}/comment (singular);
     no such route exists, so every UI-submitted comment 404'd and was lost.
     Fixed to /comments (plural). The prior e2e passed because its seed helper
     POSTs the API directly — added comment-ui.spec.ts which drives the real
     component so this can't regress silently again.

CR2: export archives (Gallery.zip / Memories.zip / HTML viewer) were written
     under media_path, which is a public ServeDir — so GET /media/exports/
     Gallery.zip served the entire event (every photo, caption, comment,
     uploader name) to any anonymous visitor at a guessable URL, bypassing the
     ticket + release gate. Moved exports to a separate EXPORT_PATH (=/exports)
     on its own volume (Dockerfile chown, compose volume, gated handler reads
     the new path). export-leak.spec.ts asserts /media/exports/Gallery.zip → 404.

Riders (git can't split hunks): LightboxModal also gains H3 live-eviction on
comment-deleted/upload-deleted; config.rs also wires compression_concurrency
from boot config (medium).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/config.rs

@@ -56,7 +56,13 @@ pub struct AppConfig {
     pub event_name: String,
     pub event_slug: String,
     pub media_path: PathBuf,
+    /// Where export archives are written. MUST be outside `media_path` — that
+    /// directory is served by a public `ServeDir`, so a predictable archive name
+    /// under it would leak the whole gallery to anonymous visitors.
+    pub export_path: PathBuf,
     pub app_port: u16,
+    /// Number of concurrent media compression workers (read once at boot).
+    pub compression_concurrency: usize,
 }
 
 impl AppConfig {
@@ -86,10 +92,18 @@ impl AppConfig {
             media_path: PathBuf::from(
                 std::env::var("MEDIA_PATH").unwrap_or_else(|_| "/media".to_string()),
             ),
+            export_path: PathBuf::from(
+                std::env::var("EXPORT_PATH").unwrap_or_else(|_| "/exports".to_string()),
+            ),
             app_port: std::env::var("APP_PORT")
                 .unwrap_or_else(|_| "3000".to_string())
                 .parse()
                 .context("APP_PORT must be a number")?,
+            compression_concurrency: std::env::var("COMPRESSION_WORKER_CONCURRENCY")
+                .ok()
+                .and_then(|v| v.parse().ok())
+                .filter(|&n| n >= 1)
+                .unwrap_or(2),
         })
     }
 }