clip-search: backlog drain + /photos/search endpoint

Wires the persistence layer for CLIP semantic search. The watcher's
per-tick drain encodes any image_exif row with a known content_hash
but no clip_embedding via Apollo (cap CLIP_BACKLOG_MAX_PER_TICK,
default 32). On a query, /photos/search encodes the text via Apollo
and reranks every stored embedding in-memory.

ExifDao additions:
- list_clip_unencoded_candidates — partial-index scan for drain
- backfill_clip_embedding — touches only the two new columns
- list_clip_index — dedup'd (hash, embedding) pull for search

clip_watch::run_clip_encoding_pass is the parallel fan-out — tokio
runtime per pass with CLIP_ENCODE_CONCURRENCY (default 4). No marker
rows for permanent failures yet; per-tick cap bounds the retry cost.

/photos/search params: q, limit, threshold (default 0.20), library,
model_version. Response is intentionally minimal (path + score) so
the frontend joins against existing photo-metadata routes lazily.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/files.rs

@@ -1938,6 +1938,35 @@ mod tests {
         ) -> Result<(), DbError> {
             Ok(())
         }
+
+        fn list_clip_unencoded_candidates(
+            &mut self,
+            _context: &opentelemetry::Context,
+            _library_id: i32,
+            _limit: i64,
+        ) -> Result<Vec<(String, String)>, DbError> {
+            Ok(Vec::new())
+        }
+
+        fn backfill_clip_embedding(
+            &mut self,
+            _context: &opentelemetry::Context,
+            _library_id: i32,
+            _rel_path: &str,
+            _embedding: &[u8],
+            _model_version: &str,
+        ) -> Result<(), DbError> {
+            Ok(())
+        }
+
+        fn list_clip_index(
+            &mut self,
+            _context: &opentelemetry::Context,
+            _library_ids: &[i32],
+            _model_version: Option<&str>,
+        ) -> Result<Vec<(String, Vec<u8>)>, DbError> {
+            Ok(Vec::new())
+        }
     }
 
     mod api {