feat(dates): backfill drain converts mixed-convention rows to true instants (#118)

Per-tick drain (backfill_utc_dates) at the existing date-drain seam,
inside the per-library online gate. Selects date_utc IS NULL AND
date_taken IS NOT NULL (new partial index idx_image_exif_utc_backfill),
re-runs resolve_dates_batch with empty priors (one exiftool subprocess
per batch, same call shape as the #117 audit), and writes only the
new-contract triple; the legacy pair stays frozen. Capped by
DATE_BACKFILL_MAX_PER_TICK; missing-file rows are paged past without
spending the cap. Legacy manual overrides convert via
manual_date_resolution rather than being re-resolved from the file.

Day-boundary invalidation deletes the day-span precomputed reels
covering a re-dated row's old/new display-zone month-day so the nightly
pre-gen regenerates them. Progress: imageserver_date_backfill_remaining
gauge + date_backfill_remaining on GET /libraries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

migrations/2026-09-26-000000_add_utc_backfill_index/down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS idx_image_exif_utc_backfill;

migrations/2026-09-26-000000_add_utc_backfill_index/up.sql

@@ -0,0 +1,9 @@
+-- Partial index backing the true-instant backfill drain (ADR-0001, ticket
+-- #118). The drain selects rows still on the legacy convention
+-- (`date_utc IS NULL`) per library in id order, and the progress surface
+-- (Prometheus `imageserver_date_backfill_remaining` + `/libraries`) counts
+-- the same set. Mirrors `idx_image_exif_date_backfill`: the index shrinks
+-- to nothing as the drain converges, so it costs ~0 after cutover.
+CREATE INDEX idx_image_exif_utc_backfill
+    ON image_exif (library_id, id)
+    WHERE date_utc IS NULL;