Photoprism shouldn't be in consideration at all. They felt the need to post in their FAQ that not checking authorization/authentication before serving photos* if directly linked is OK because its "industry standard" and (paraphrased) "difficult/impossible to implement"

* might just be thumbnails. But lets be honest- a 1/10 scale thumbnail of 40MP shot is... still a ton of detail.