fix(review): surface auth-expiry, harden add-batch rollback, add audit log

Follow-up to the ce-code-review deferred items on the photo editor:

- Photo editor fetches now REJECT with a status-bearing error (apiSend)
  instead of the boolean apiOk that swallowed the HTTP code. Reorder,
  delete and add paths tell a lapsed login (401/403) apart from a generic
  failure and prompt the owner to sign in again rather than "try again".
- Add-batch rollback: the per-file cleanup DELETEs no longer swallow
  individual failures. If any rollback DELETE doesn't land (a stray
  stock-named file could steal the lexicographic cover slot), the owner is
  told cleanup was incomplete and to reload — instead of a false "rolled
  back cleanly".
- entry-actions delete + reorder routes now emit an owner-attributed audit
  log line, so a destructive mutation is traceable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/entry-actions/classes/EntryActionsApiController.php

@@ -63,6 +63,9 @@ class EntryActionsApiController extends AbstractApiController
 
         Folder::delete($path);
         $this->grav['cache']->deleteAll();
+        // Audit trail: entry deletion is destructive and owner-only — record who
+        // did it and to what, so an unexpected disappearance is traceable.
+        $this->grav['log']->info(sprintf('entry-actions: owner "%s" deleted entry "%s"', $user->username, $slug));
 
         return ApiResponse::noContent();
     }
@@ -124,6 +127,9 @@ class EntryActionsApiController extends AbstractApiController
 
         PhotoRenumberer::renumber($path, $names);
         $this->grav['cache']->deleteAll();
+        // Audit trail: mirror deleteEntry — record the owner mutating an entry's
+        // photo order (and how many files the manifest listed).
+        $this->grav['log']->info(sprintf('entry-actions: owner "%s" reordered %d photo(s) for entry "%s"', $user->username, count($names), $slug));
 
         return ApiResponse::noContent();
     }