Fix DB paths, add auth to sensitive endpoints, misc bug fixes

- scheduler.py: Use full path for scheduler_state.db instead of relative name
- recycle.py: Use full path for thumbnails.db instead of relative name
- cloud_backup.py, maintenance.py, stats.py: Require admin for config/cleanup/settings endpoints
- press.py: Add auth to press image serving endpoint
- private_gallery.py: Fix _create_pg_job call and add missing secrets import
- appearances.py: Use sync httpx instead of asyncio.run for background thread HTTP call

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/backend/routers/private_gallery.py

@@ -21,6 +21,7 @@ import json
 import mimetypes
 import os
 import re
+import secrets
 import shutil
 import tempfile
 import time
@@ -6968,7 +6969,7 @@ async def migrate_to_chunked(
 
     # Run migration in background thread
     job_id = f"pg_migrate_{secrets.token_hex(6)}"
-    _update_pg_job(job_id, {
+    _create_pg_job(job_id, {
         'status': 'running',
         'total_files': len(to_migrate),
         'processed_files': 0,