fix: correct token read in upload + remove upload button, keep drop zone

- api.upload.photo used wrong localStorage key ('access_token' vs 'hotelsync-session')
- Removed standalone 'Загрузить фото' button — drop zone handles click+drag
- Added '+' thumbnail button to add more photos when gallery is non-empty
- Show spinner inline during upload instead of disabled button

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/api.ts

@@ -347,7 +347,7 @@ export const api = {
   // ── File Upload ───────────────────────────────────────────────────────────
   upload: {
     photo: async (file: File, folder: 'categories' | 'rooms' | 'hotels' | 'guests' = 'rooms'): Promise<string> => {
-      const token = localStorage.getItem('access_token')
+      const token = getToken()
       const fd = new FormData()
       fd.append('file', file)
       const res = await fetch(`${BASE}/api/upload?folder=${folder}`, {