Starting point
Measure a small photo import, record originals and previews separately, then name the person who can recover the collection.
Workflow boundary
Review new imports monthly; keep the recovery owner outside the ordinary uploader role.
Resource boundary
Grove is a starting catalogue allocation to evaluate: 2 vCPU, 4 GB RAM, 60 GB SSD and 2 TB monthly transfer. Measure the actual application; no service count or performance result is implied.
Ownership
Give members application accounts, keep host administration limited, and identify a backup maintainer.
Recovery outcome
Complete the recovery kit and test a separate restore before relying on the design.