Initial commit of Vellum, an event photo product for guest uploads, host moderation, and original-quality galleries.

Co-authored-by: Cursor <cursoragent@cursor.com>

AGENTS.md

@@ -0,0 +1,17 @@
+# Vellum repository guidance
+
+- Use Bun exclusively for dependency installation and project scripts. Do not
+  introduce npm, pnpm, or Yarn lockfiles or commands.
+- Keep event-owned database reads and writes scoped by `event_id` (or the
+  hosting `user_id` for event records).
+- Store timestamps as timezone-aware values.
+- Do not import `@album/database` into client components.
+- Cross-application payloads belong in `@album/contracts`, not in duplicated
+  local interfaces.
+- Never log contributor names, emails, or object keys in bulk. Log photo and
+  event ids only.
+- Send testing email only to Mailpit through the non-production mail
+  configuration. Never send tests through a production provider.
+- Guest gallery queries must return approved photos only.
+- Uploads go directly to object storage via short-lived presigned PUTs. Do not
+  stream original files through Next.js.