Add fotos.carloselugo.com photo-upload service

Event photo upload app with OAuth2 (Google Drive), Caddy route, and
env-var-driven compose config. Refresh token persists to token.json
so re-auth isn't needed after container restarts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -213,6 +213,26 @@ services:
   #   sysctls:
   #     - net.ipv6.conf.all.disable_ipv6=1
 
+  # ─── Fotos del Evento — fotos.carloselugo.com ─────────────────────────────
+  fotos:
+    build: ./photo-upload
+    container_name: fotos
+    restart: unless-stopped
+    environment:
+      - DRIVE_FOLDER_ID=${DRIVE_FOLDER_ID}
+      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
+      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
+      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
+      - GOOGLE_OAUTH_REFRESH_TOKEN=${GOOGLE_OAUTH_REFRESH_TOKEN}
+      - OAUTH_REDIRECT_URI=${OAUTH_REDIRECT_URI}
+      - PORT=3000
+    volumes:
+      - ./photo-upload/upload_status.json:/app/upload_status.json
+      - ./photo-upload/token.json:/app/token.json
+    networks:
+      - web-net
+    # No exponemos puertos al host: Caddy llega por la red interna
+
   # ─── Hit Counter ───────────────────────────────────────────────────────────
   hit-counter:
     build: ./hit-counter