Fix DB paths, add auth to sensitive endpoints, misc bug fixes

- scheduler.py: Use full path for scheduler_state.db instead of relative name
- recycle.py: Use full path for thumbnails.db instead of relative name
- cloud_backup.py, maintenance.py, stats.py: Require admin for config/cleanup/settings endpoints
- press.py: Add auth to press image serving endpoint
- private_gallery.py: Fix _create_pg_job call and add missing secrets import
- appearances.py: Use sync httpx instead of asyncio.run for background thread HTTP call

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/backend/routers/appearances.py

@@ -1615,9 +1615,9 @@ def send_appearance_notification(notifier: PushoverNotifier, celebrity_name: str
                     # TMDb image URL format
                     poster_url = f"https://image.tmdb.org/t/p/w500{poster_url_path}"
 
-                # Download poster to temp file
-                import asyncio
-                response = asyncio.run(http_client.get(poster_url))
+                # Download poster to temp file (sync HTTP call since this runs in background thread)
+                import httpx
+                response = httpx.get(poster_url, timeout=10.0)
 
                 if response.status_code == 200:
                     # Create temp file - strip query params before getting extension