Convoa 0.5.0-dev gallery validation

PASS: private, password, excluded and category forums omitted
PASS: private, unapproved, future and moved topics omitted
PASS: result limit applied
PASS: news forum selection intersected with ACL
PASS: poll selection only returns visible polls
PASS: empty permissions fail closed without invalid SQL
PASS: visitor with no forum access sees no forums
PASS: forum IDs validated and deduplicated
PASS: admin rejects invalid IDs
PASS: limits bounded
PASS: services YAML parses with bundled Symfony
PASS: routing YAML parses with bundled Symfony
PASS: portal_body.html Twig syntax
PASS: acp_portal.html Twig syntax
PASS: event/overall_header_navigation_prepend.html Twig syntax
PASS: welcome and topic titles escaped with phpBB autoescape disabled
PASS: ACP welcome value cannot break out of textarea
All portal tests passed.
PASS: repository dependency injection resolves
PASS: controller dependency injection resolves
PASS: language event registers extension language
PASS: config and ACP migration declarations load
PASS: ACP requires extension and board-administration permissions
Dependency and registration tests passed.
PASS: My albums shows only albums owned by the current member
PASS: owner sees own pending photo in album count
PASS: other members see public albums with approved count and cover only
PASS: album search finds creator names
PASS: another member has no duplicated or inherited galleries
PASS: private gallery cannot be browsed by another member
PASS: another member cannot delete a public photo
PASS: moderator can inspect private galleries
PASS: guest can browse public galleries without private album leakage
PASS: guest cannot access My albums
PASS: owner can delete photo and retrieve its encrypted blob for cleanup
PASS: photo deletion removes comments and ratings
PASS: exactly ten distinct shared sample images
PASS: samples never create per-member database albums
PASS: valid photo is accepted
PASS: photos above 10 MB are rejected even if admin upload maximum is 20 MB
PASS: module_albums.html parses
PASS: album_sample.html parses
PASS: convoa_dashboard.css.html parses
PASS: album names and owner names are HTML escaped
All gallery checks passed.

HTTP integration: ten sample thumbnails and full viewer, guest My albums denial, member album creation, real JPEG upload and byte-exact delivery, owner delete controls, missing-CSRF rejection, confirmed deletion, database and encrypted blob cleanup, deleted URL 404. All passed.

Browser: visually checked the shared Samples Gallery and saved Convoa-Albums-Preview.png, including all ten sample cards.

Fresh full-install ZIP integrity, manifest hashes and automatic CMS activation are checked by tests/convoa_package_test.py.
