Fix: uploaded photos 404'd behind /api — nginx served them from the SPA root