feat: Add photo galleries to services, resource types management, and UI improvements

Major features:
- Add drag-and-drop photo gallery to Service create/edit modals
- Add Resource Types management section to Settings (CRUD for custom types)
- Add edit icon consistency to Resources table (pencil icon in actions)
- Improve Services page with drag-to-reorder and customer preview mockup

Backend changes:
- Add photos JSONField to Service model with migration
- Add ResourceType model with category (STAFF/OTHER), description fields
- Add ResourceTypeViewSet with CRUD operations
- Add service reorder endpoint for display order

Frontend changes:
- Services page: two-column layout, drag-reorder, photo upload
- Settings page: Resource Types tab with full CRUD modal
- Resources page: Edit icon in actions column instead of row click
- Sidebar: Payments link visibility based on role and paymentsEnabled
- Update types.ts with Service.photos and ResourceTypeDefinition

Note: Removed photos from ResourceType (kept only for Service)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/src/api/auth.ts

@@ -86,15 +86,15 @@ export const refreshToken = async (refresh: string): Promise<{ access: string }>
 };
 
 /**
- * Masquerade as another user
+ * Masquerade as another user (hijack)
  */
 export const masquerade = async (
-  username: string,
-  masquerade_stack?: MasqueradeStackEntry[]
+  user_pk: number,
+  hijack_history?: MasqueradeStackEntry[]
 ): Promise<LoginResponse> => {
   const response = await apiClient.post<LoginResponse>(
-    `/api/users/${username}/masquerade/`,
-    { masquerade_stack }
+    '/api/auth/hijack/acquire/',
+    { user_pk, hijack_history }
   );
   return response.data;
 };
@@ -106,7 +106,7 @@ export const stopMasquerade = async (
   masquerade_stack: MasqueradeStackEntry[]
 ): Promise<LoginResponse> => {
   const response = await apiClient.post<LoginResponse>(
-    '/api/users/stop_masquerade/',
+    '/api/auth/hijack/release/',
     { masquerade_stack }
   );
   return response.data;