Thumb orientation + library filter on /photos/exif

Two follow-ups on the same feature branch:

1. Bake EXIF orientation into generated thumbnails. The `image` crate
   doesn't apply Orientation on load, and `save_with_format(..Jpeg)`
   drops EXIF — so portrait phone shots ended up sideways in any client
   that displays the cached thumb directly (no EXIF tag for the browser
   to compensate from). New `exif::read_orientation` reads the tag
   cheaply (no full EXIF parse) and `exif::apply_orientation` does the
   rotate/flip via image's existing `rotate90/180/270` + `fliph/flipv`.
   Applied in both branches of `generate_image_thumbnail` (RAW embedded-
   JPEG path and the regular `image::open` path). Existing thumbnails
   in the cache are still wrong-orientation; wipe the thumb dir or run
   a one-off backfill once this lands.

2. Optional `library` query param on `/photos/exif`. Accepts numeric id
   or name (same shape as `/image?library=...`), resolved via the
   existing `resolve_library_param` helper so a bad value 400s before
   we touch the DAO. Filter is applied post-query in the handler
   rather than pushed into `query_by_exif` to keep the DAO trait
   (and its test mocks) unchanged. Cheap enough at typical library
   counts; can be moved into SQL later if it ever isn't.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/main.rs

@@ -1071,6 +1071,13 @@ pub fn unsupported_thumbnail_sentinel(thumb_path: &Path) -> PathBuf {
 }
 
 fn generate_image_thumbnail(src: &Path, thumb_path: &Path) -> std::io::Result<()> {
+    // The `image` crate doesn't auto-apply EXIF Orientation on load, and
+    // saving back out as JPEG drops EXIF entirely — so without baking the
+    // rotation into the pixels here, browsers see the raw landscape buffer
+    // of a portrait phone shot and render it sideways. Read once up front
+    // and apply to whichever decode branch we end up taking.
+    let orientation = exif::read_orientation(src).unwrap_or(1);
+
     // RAW formats (ARW/NEF/CR2/etc): try the file's embedded JPEG preview
     // first. Avoids ffmpeg choking on proprietary RAW compression (Sony ARW
     // in particular), and is faster than decoding RAW pixels anyway.
@@ -1081,6 +1088,7 @@ fn generate_image_thumbnail(src: &Path, thumb_path: &Path) -> std::io::Result<()
                 format!("decode embedded preview {:?}: {}", src, e),
             )
         })?;
+        let img = exif::apply_orientation(img, orientation);
         let scaled = img.thumbnail(200, u32::MAX);
         scaled
             .save_with_format(thumb_path, image::ImageFormat::Jpeg)
@@ -1095,6 +1103,7 @@ fn generate_image_thumbnail(src: &Path, thumb_path: &Path) -> std::io::Result<()
     let img = image::open(src).map_err(|e| {
         std::io::Error::new(std::io::ErrorKind::InvalidData, format!("{:?}: {}", src, e))
     })?;
+    let img = exif::apply_orientation(img, orientation);
     let scaled = img.thumbnail(200, u32::MAX);
     scaled
         .save(thumb_path)