Fix DB paths, add auth to sensitive endpoints, misc bug fixes

- scheduler.py: Use full path for scheduler_state.db instead of relative name
- recycle.py: Use full path for thumbnails.db instead of relative name
- cloud_backup.py, maintenance.py, stats.py: Require admin for config/cleanup/settings endpoints
- press.py: Add auth to press image serving endpoint
- private_gallery.py: Fix _create_pg_job call and add missing secrets import
- appearances.py: Use sync httpx instead of asyncio.run for background thread HTTP call

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/backend/routers/scheduler.py

@@ -91,7 +91,7 @@ async def get_scheduler_status(
             if forum_cfg.get('enabled', False):
                 enabled_forums.add(forum_cfg.get('name'))
 
-    with sqlite3.connect('scheduler_state') as sched_conn:
+    with sqlite3.connect(str(settings.PROJECT_ROOT / 'database' / 'scheduler_state.db')) as sched_conn:
         cursor = sched_conn.cursor()
 
         # Get all tasks
@@ -332,7 +332,7 @@ async def pause_scheduler_task(
     """Pause a specific scheduler task."""
     app_state = get_app_state()
 
-    with sqlite3.connect('scheduler_state') as sched_conn:
+    with sqlite3.connect(str(settings.PROJECT_ROOT / 'database' / 'scheduler_state.db')) as sched_conn:
         cursor = sched_conn.cursor()
 
         cursor.execute("""
@@ -372,7 +372,7 @@ async def resume_scheduler_task(
     """Resume a paused scheduler task."""
     app_state = get_app_state()
 
-    with sqlite3.connect('scheduler_state') as sched_conn:
+    with sqlite3.connect(str(settings.PROJECT_ROOT / 'database' / 'scheduler_state.db')) as sched_conn:
         cursor = sched_conn.cursor()
 
         cursor.execute("""
@@ -412,7 +412,7 @@ async def skip_next_run(
     """Skip the next scheduled run by advancing next_run time."""
     app_state = get_app_state()
 
-    with sqlite3.connect('scheduler_state') as sched_conn:
+    with sqlite3.connect(str(settings.PROJECT_ROOT / 'database' / 'scheduler_state.db')) as sched_conn:
         cursor = sched_conn.cursor()
 
         # Get current task info
@@ -480,7 +480,7 @@ async def reschedule_task(
     except ValueError:
         raise HTTPException(status_code=400, detail="Invalid datetime format")
 
-    with sqlite3.connect('scheduler_state') as sched_conn:
+    with sqlite3.connect(str(settings.PROJECT_ROOT / 'database' / 'scheduler_state.db')) as sched_conn:
         cursor = sched_conn.cursor()
         cursor.execute(
             "UPDATE scheduler_state SET next_run = ? WHERE task_id = ?",