diff --git a/app.css b/app.css
index 0598a24..235fc20 100644
--- a/app.css
+++ b/app.css
@@ -187,16 +187,19 @@ body {
 
 .photo-grid {
     display: grid;
-    grid-template-columns: repeat(3, 1fr);
+    grid-template-columns: repeat(auto-fill, minmax(100px, 1fr));
     gap: 6px;
     margin-top: 10px;
+    max-width: 600px;
 }
 .photo-grid .thumb {
     aspect-ratio: 1;
+    max-width: 160px;
     background: #2a2a30;
     border-radius: 6px;
     overflow: hidden;
     position: relative;
+    cursor: pointer;
 }
 .photo-grid .thumb img {
     width: 100%;
diff --git a/lib/api.js b/lib/api.js
index a003e04..bd4cb73 100644
--- a/lib/api.js
+++ b/lib/api.js
@@ -101,7 +101,17 @@
         const r = await fetch(API_BASE + '/photo.php?' + params.toString(), {
             headers: { Authorization: 'Bearer ' + t },
         });
-        if (!r.ok) return null;
+        if (!r.ok) {
+            const body = await r.text().catch(() => '');
+            console.warn('photo.php failed', r.status, relpath, body);
+            return null;
+        }
+        const ct = r.headers.get('Content-Type') || '';
+        if (!ct.startsWith('image/')) {
+            const body = await r.text().catch(() => '');
+            console.warn('photo.php not an image', ct, body);
+            return null;
+        }
         const blob = await r.blob();
         const url = URL.createObjectURL(blob);
         blobUrlCache.set(key, url);