1. They probably do, they just don't want to bother to take the time to help their users do it properly. So, I'm guessing you're on a shared webhost where the web server runs as www:www and you have your own username and group, bluestrobe:bluestrobe. The webserver probably needs rwx on the files in order to be able to manipulate them properly. In this case I'd probably try to chgrp them all to www and set the permissions as 775 or 770 or something like that. You could chown probably them to www as an alternative but that might make them a bit harder to manage. It doesn't really matter whether the files are inside the web root or not, the risk is from other users on the same system, not from the web. If gallery needs to write to these files, you're wide open to a web attack and relying on gallery not to mess up.
2. Are you sure you don't have ssh or telnet access or anything like that? If not, I'd look for chmod and chown or chgrp functions in php, and write a script that makes the requisite changes after getting some kind of identification from you (assuming you're going to run the script by visiting it in a browser). Or you could use system() to run the actual unix versions of those commands.
