[jasrasr]

Fixes #135 (stacked on PR #134)

Issue #135 requests attaching multiple photos after an existing workout was saved, viewing previously uploaded photos, longer logins, a sign-out button and a User Management link. This PR implements those enhancements on top of PR #134's authenticated photo viewer, backups and attendance dashboard.

Saved workout photos

• Edit → Add pictures to this workout provides a multiple-image picker suitable for mobile. Upload up to five JPEG/PNG/WebP files per request (5 MB each), 12 total per workout.
• Existing photo values remain intact. Append filenames to optional photos array; no migration or overwriting a workout entry. Uploads are validated for size, MIME, image integrity and safe per-user paths; unique filenames, revision-checked JsonStore::update, audit snapshots and rollback on failure.
• Details displays a gallery containing both old and new pictures. ?photo=entry-id&image=N routes by index only, never by client-supplied filenames; owner authorization remains required. Private ZIP backup includes every referenced image.

Login / navigation

• Responsive User Management link and CSRF-protected Sign out form in Workout Tracker. Sign out uses the existing central portal, revoking the shared browser session across integrated projects.
• The shared portal offers opt-in Stay signed in for 7 days. The default remains 30-minute idle/session cookie. Opting in sets a bounded, HttpOnly/SameSite=Strict secure persistent cookie and matching server expiry, while retaining version-based revocation. No permanent API tokens, password storage or insecure client-side login cache.

Safety / tests

• No live runtime JSON, photos or credentials are committed or touched. Old workouts and metadata remain unchanged.
• Isolated PHP tests validate multiple image attachment, backups, owner scoping and stale-write handling. Isolated Node/PHP HTTP tests check default login, remembered cookie, seven-day expiry and full logout. CI also runs existing Workout Tracker validations.
• Before Hostinger release, back up ignored workout and central user-management storage, verify live HTTPS cookie settings, PHP session persistence, signed-out/other-user photo denial, and iPhone multi-upload UX.

Stacked merge sequence

First review and merge PR #134 into main (regular merge commit), then retarget this PR to main and rerun validation. Do not merge automatically without the user's explicit approval.