feat(model-manager): add "Delete all" gallery button + clearer 401 errors

- Gallery: DELETE /api/gallery/all removes every image under output/;
  "Delete all" button with in-app confirm and a deleted/failed count.
- Downloads: surface a clear, actionable message when CivitAI/HuggingFace
  returns 401/403 (model requires login/early-access, or the key/token
  lacks access) instead of a bare error, both at resolve time and during
  the download stream.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

model-manager/app/static/app.js

@@ -376,7 +376,28 @@ document.addEventListener("keydown", (e) => {
 $("#lbDelete").addEventListener("click", () => {
   if (lbCurrent) deletePhoto(lbCurrent.p, lbCurrent.card);
 });
+async function deleteAllPhotos() {
+  if (!galleryState.total) {
+    toast($("#galleryToast"), "No photos to delete", false);
+    return;
+  }
+  const ok = await confirmDialog(
+    `Permanently delete ALL ${galleryState.total} photo(s)? This cannot be undone.`,
+    "Delete all");
+  if (!ok) return;
+  try {
+    const res = await api("/api/gallery/all", { method: "DELETE" });
+    let msg = `Deleted ${res.deleted} photo(s)`;
+    if (res.failed) msg += ` (${res.failed} could not be removed — permissions)`;
+    toast($("#galleryToast"), msg, res.failed > 0);
+    loadGallery(true);
+  } catch (err) {
+    toast($("#galleryToast"), err.message, true);
+  }
+}
+
 $("#refreshGallery").addEventListener("click", () => loadGallery(true));
+$("#deleteAllGallery").addEventListener("click", deleteAllPhotos);
 $("#galleryMore").addEventListener("click", () => loadGallery(false));
 
 // ---- browse civitai -------------------------------------------------------