feat(dates): photo date filters on the true instant (#152)

date_from / date_to on /photos, /photos/exif and unified search ran on
the legacy mixed-convention date_taken, so a photo could display inside
a range yet be filtered out of it by up to its UTC offset (or by years,
for rows the filename class re-dated).

The filter lives in the shared ExifDao::query_by_exif, so it's fixed
once there:

- query_by_exif takes Option<date_view::InstantRange> (bounds + display
  and server zones) instead of raw date_from / date_to.
- SQL pre-filter: converted rows on date_utc exactly; unconverted rows
  (drain pending, permanent floor) on date_taken widened by
  LEGACY_INSTANT_BAND_SECS (±15 h, now shared with /memories). Converted
  rows are deliberately not bounded by date_taken: a re-dated row's
  legacy value can sit years from its instant.
- Exact pass in Rust via InstantRange::contains → row_true_instant, so
  every returned row's true instant is inside the range.

Calendar days now mean the owner's days: nl_query::iso_to_unix builds
day bounds in the display zone (it used UTC midnights, which only lined
up with the legacy wall-as-UTC column), and unified search's "today" is
the owner's today rather than UTC's. The midnight-with-DST-gap fallback
moves from memories_anchor into date_view::day_start_instant.

Compatibility: clients already sending real instants (Apollo's
/photos/exif windows) get correct edges with no change. Clients sending
UTC-midnight day bounds see ranges shift by up to the UTC offset until
they send display-zone bounds.

No index on date_utc; the OR clause scans, which is milliseconds at
personal-library scale (same as /memories today).

dev/e2e check gains /photos/exif wall_clock + true_instant assertions and
range-edge checks ([t, t] in, [.., t-1] and [t+1, ..] out). Not run here:
the harness needs the WSL + Windows toolchain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/data/mod.rs

@@ -151,7 +151,9 @@ pub struct FilesRequest {
     pub gps_lon: Option<f64>,
     pub gps_radius_km: Option<f64>,
 
-    // Date range filtering (Unix timestamps)
+    // Date range filtering: inclusive true instants (unix seconds), compared
+    // against each row's true instant (ADR-0001, #152). For calendar days,
+    // send the day's bounds in the owner's display zone.
     pub date_from: Option<i64>,
     pub date_to: Option<i64>,
 
@@ -530,7 +532,8 @@ pub struct ExifBatchResponse {
 
 #[derive(Debug, Deserialize)]
 pub struct ExifBatchRequest {
-    /// Lower bound (inclusive) for `image_exif.date_taken`, unix seconds.
+    /// Lower bound (inclusive) on the row's true instant (`true_instant`),
+    /// unix seconds. Same semantics as `date_from` on `/photos`.
     pub date_from: Option<i64>,
     /// Upper bound (inclusive). Same semantics as `date_to` on `/photos`.
     pub date_to: Option<i64>,