Backend PR: tcg-collector-backend#427, targeting staging.

Global user authentication fails closed for private namespaces, retains owner-filtered SQL, avoids caching private/authentication responses and redacts credentials. A conditional database upsert enforces the email resend interval under concurrent requests. Tokens remain opaque and revocable; no new expiry or mobile renewal flow is introduced.

Local validation: 998 API tests, 527 ingest tests, and both TypeScript test-layer checks passed under Node 22.23.3. Local PostgreSQL/Docker e2e is blocked because the Docker Desktop Linux engine is not running. No VPS deployment or migration was performed; the PR is not evidence of production activation.

GitHub CI: API e2e, ingest integration, both unit/typecheck jobs and the probe build passed. Full Compose smoke is blocked before API startup by unchanged scanner pins: numpy==2.5.3 conflicts with ultralytics==8.2.60 requiring numpy<2.0.0. Resolve that separate dependency conflict and rerun smoke before considering the backend PR fully validated for merge/deployment. The docs workflow currently runs only for main; staging validation was performed locally.

The companion FR/EN architecture pages document API/database/scan/media flows and public-versus-private boundaries. Catalogue artwork remains public pending clarification of the requested collection-image restriction. No dedicated private collection-photo storage/delivery feature was added.