master
feat: image management endpoints + CORS for admin SPA
feat: delta-sync + routes API, hardened and tested