feat: delete photo from server on remove + fix file drag-and-drop

- DELETE /api/upload?url= endpoint removes file from disk (with path traversal protection)
- api.upload.deletePhoto() helper in frontend
- removePhoto() now calls deletePhoto for cdn.hotelsync.ru URLs (best-effort)
- handleDragOver only highlights drop zone for external file drags (not thumbnail DnD)
- <img> in preview gets draggable={false} + pointer-events-none to not interfere with drops

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/api.ts

@@ -359,6 +359,10 @@ export const api = {
       const data = await res.json() as { url: string }
       return data.url
     },
+
+    deletePhoto: async (url: string): Promise<void> => {
+      await req('DELETE', `/api/upload?url=${encodeURIComponent(url)}`)
+    },
   },
 
   // ── Categories ────────────────────────────────────────────────────────────