feat: recursive subfolder filtering + gallery tree navigation

[ghosttigerllc-bit]

Summary

• Recursive subfolder filtering: selecting an intermediate folder (e.g. 2025/08/) shows all images in child folders
• Gallery page tree navigation panel with collapsible folder hierarchy, sticky positioning, and drag-to-resize
• Thumbnail size controls (S/M/L buttons) for adjustable grid density
• Fix path collision when multiple gallery roots share overlapping relative paths (P1 from feat: multi-directory gallery scan with folder filter (#126) #135 review)
• Fix auto-detect mode collapsing nested folders to ambiguous basenames (P2 from feat: multi-directory gallery scan with folder filter (#126) #135 review)
• Security test suite for path traversal edge cases (symlink escape, null bytes, traversal sequences)

Changes

Backend

• database/operations.py: Added include_ancestors parameter to get_prompt_subfolders() — generates all intermediate path segments for tree rendering
• py/api/prompts.py: /subfolders endpoint accepts ?include_ancestors=true
• py/api/images.py: /gallery/subfolders endpoint also accepts ?include_ancestors=true; serve_output_image accepts optional ?root=N for future multi-root disambiguation; auto-detect mode preserves full folder paths instead of collapsing to basenames

Frontend

• web/js/admin.js: Subfolder dropdown requests hierarchical data and renders with indentation
• web/js/gallery.js: Folder tree panel (collapsible, sticky, resizable), subfolder filtering on image grid, S/M/L thumbnail size buttons using inline grid-template-columns
• web/gallery.html: Split-pane layout with independently-scrolling folder tree and image grid

Tests

• tests/test_lora_database.py: 3 new tests for include_ancestors behavior
• tests/test_path_security.py: 12 new tests covering symlink escape, path traversal, null bytes, and root index validation

Test plan

• All 22 existing subfolder/database tests pass
• 3 new ancestor hierarchy tests pass
• 12 new path security tests pass
• Manual testing with deeply nested date-based folder structure (20,618 images)
• Manual testing of tree navigation, folder filtering, and thumbnail sizing
• Verified sticky sidebar scrolls independently from gallery grid

Addresses feedback from #126 (subfolder filtering + gallery navigation).
Fixes code review items P1 and P2 from #135.

[vitosans]

Can you fix the linting errors? Also I will be traveling for the next few days will be checking remote.

[ghosttigerllc-bit]

Thanks for the quick review! I'll fix the linting errors and push an update.

Safe travels — no rush on the review.

-kai

[ghosttigerllc-bit]

Hey @vitosans — just a heads up, the lint fix has been pushed (commit 1681cbb). Black formatting applied to test_path_security.py, flake8 clean. CI hasn't triggered on the new commit yet — might need a manual re-run on your end. No rush, whenever you're back from traveling! 🐾

[ghosttigerllc-bit]

Hey @vitosans — quick heads up, filed #142 for a minor UX issue: the scan dialog says "Only images with ComfyUI metadata will be processed" but the code also supports A1111/Reforge parameters format. The text is misleading for users with mixed-source libraries.

Happy to include the fix in this PR if you'd prefer to keep it bundled. Let us know! 🐾

[vitosans]

Sorry, just touched down today. Did not have access while I was out.