Auth based on tags

[haku]

currently all auth is based on directory structure, which makes it very awkward to share a sub-set of images like a set from a specific event. it would be nice to grant users access to items based on a tag they have.

parts:

• update DB to store tag access so searches work as expected
• UI for assigning users to tags

questions:

• who has access to assign auth to a tag?
• does that then restrict who can add/remove that tag from an item?
• how do users know which tags they have access to?
• what happens when automation (tag determiners, bulk import) assign an auth tag?

is there a new permission +manageauthtags? or a more complex way would be for each auth tag to have read/write and read-only users, where write refers to adding or removing the auth tag from an item.