Auth based on tags

[haku]

currently all auth is based on directory structure, which makes it very awkward to share a sub-set of images like a set from a specific event.
it would be nice to grant users access to items based on a tag they have.

parts:

• update DB to store tag access so searches work as expected
• UI for assigning users to tags

questions:

• who has access to assign auth to a tag?
• does that then restrict who can add/remove that tag from an item?
• how do users know which tags they have access to?
• what happens when automation (tag determiners, bulk import) assign an auth tag?

is there a new permission +manageauthtags?
or a more complex way would be for each auth tag to have read/write and read-only users, where write refers to adding or removing the auth tag from an item.

[haku]

design idea so far:

• new --userfiile and AUTH file permission +manageauth (like +edittags)
• users with it in the userfile can add/remove users from an access tag using a UI page for such (maybe /access-tags ?)
• auth tags are stored in a dedicated auth DB with columns [tag, user]
• the cli flag for specifying its path functions as a opt-in feature flag
• users who also have it in an AUTH file can add/remove access tags from items in that directory tree.
• access-tags have some kinda easily recognisable format, maybe starting with a specific sequence, that automation is not allowed to add.
• access-tags a user has permission to view show on the home page (like favs do)
• the resultant ACL for an item is sorted in a second auth column (tagauth?) that is checked during queries and when serving items

possible issues:

• can a user set an existing tag as an auth tag? cos that could be privilege escalation
• what format should auth tags have that is different from regular tags? something in the tag? special reserved cls value?

alternatives considered:

• can only specify tag auth via cli, must be able to edit config file to make an access tag, does not address who can add/remove an access tag