Split main.rs: extract backfill drains and thumbnails into modules

main.rs drops from 3542 → ~2930 lines by moving:

- src/backfill.rs (new): backfill_unhashed_backlog,
  backfill_missing_date_taken, backfill_missing_content_hashes,
  build_face_candidates, process_face_backlog. Now unit-tested for
  the first time — 5 tests covering cap behavior, library-id
  filtering, missing-on-disk skip, and the video/unhashed/scanned
  filters on face-candidate selection.

- src/thumbnails.rs (new): unsupported_thumbnail_sentinel,
  generate_image_thumbnail, create_thumbnails, update_media_counts,
  is_image, is_video, plus the IMAGE_GAUGE / VIDEO_GAUGE Prometheus
  metrics. Replaces the no-op stubs that used to live in lib.rs.
  4 new unit tests for the sentinel path math and the
  walker-counts-images-vs-videos smoke path.

Supporting:
- SqliteExifDao::from_shared (test-only) so an SqliteExifDao and
  SqliteFaceDao can share one in-memory connection — required to
  test build_face_candidates against the real join.
- files.rs / video/{mod,actors}.rs import from crate::thumbnails::*
  instead of the now-removed stubs in lib.rs.

cargo test --bin image-api: 325 passing (was 314).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/database/mod.rs

@@ -797,6 +797,15 @@ impl SqliteExifDao {
             connection: Arc::new(Mutex::new(conn)),
         }
     }
+
+    /// Test-only constructor that shares an already-wrapped connection.
+    /// Required when another DAO (e.g. `SqliteFaceDao`) needs to read
+    /// rows this DAO writes, so cross-table joins resolve against the
+    /// same in-memory SQLite instance.
+    #[cfg(test)]
+    pub fn from_shared(connection: Arc<Mutex<SqliteConnection>>) -> Self {
+        SqliteExifDao { connection }
+    }
 }
 
 impl ExifDao for SqliteExifDao {