feat(api): photo visibility lifecycle with audit and outbox events

Serializes turbo tasks (concurrency=1): api and worker e2e suites share
one MySQL/MinIO and resetDb TRUNCATEs raced when run in parallel.

Co-Authored-By: Claude Code <noreply@anthropic.com>

services/api/src/public/public.controller.ts

@@ -21,6 +21,7 @@ import {
   DEFAULT_PUBLIC_PHOTO_PAGE_SIZE,
   MAX_PUBLIC_PHOTO_PAGE_SIZE,
   type PublicAlbumResponse,
+  type PublicPhotoDetailResponse,
   type PublicPhotoListResponse,
   PublicService,
 } from './public.service';
@@ -80,4 +81,16 @@ export class PublicController {
       limit: parsePublicPhotoLimit(limit),
     });
   }
+
+  /**
+   * 公开单图：深链定位；隐藏/删除/换册后的旧链接 404 PHOTO_NOT_PUBLIC。
+   * 每次调用现签 thumb/browse（契约规定的过期刷新入口）。
+   */
+  @Get(':token/photos/:photoId')
+  getPublicPhoto(
+    @Param('token') token: string,
+    @Param('photoId') photoId: string,
+  ): Promise<PublicPhotoDetailResponse> {
+    return this.publicService.getPublicPhoto(token, photoId);
+  }
 }