fix: honor library param in /image, /photos, /memories

The Phase 3 plumbing accepted `library=` but didn't actually route
requests through the scoped library once it was resolved. Three
concrete bugs surfaced when testing against a second mounted library:

- `/image` always resolved paths against AppState.base_path (primary),
  so thumbnails for non-primary libraries 400'd when their rel_paths
  didn't exist under primary. Now resolves against the scoped library
  and defaults to primary when the param is omitted.

- `/memories` walked the scoped library correctly but its helper
  functions hardcoded `library_id: PRIMARY_LIBRARY_ID` on every
  MemoryItem, causing clients to route thumbnails back to primary
  regardless of which library the memory actually came from.

- `/photos` non-recursive listing delegated to a `RealFileSystem`
  constructed from AppState.base_path at startup, so walks always
  hit primary even when `library=2` was passed. The non-primary
  path now uses list_files against the scoped library's root;
  primary still goes through FileSystemAccess to preserve the
  existing test mock plumbing.

Also adds `library` to ThumbnailRequest so the /image query param
is actually parsed.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/data/mod.rs

@@ -192,6 +192,10 @@ pub struct ThumbnailRequest {
     pub(crate) format: Option<ThumbnailFormat>,
     #[serde(default)]
     pub(crate) shape: Option<ThumbnailShape>,
+    /// Optional library filter. Accepts a library id (e.g. "1") or name
+    /// (e.g. "main"). When omitted, defaults to the primary library.
+    #[serde(default)]
+    pub(crate) library: Option<String>,
 }
 
 #[derive(Debug, Deserialize, PartialEq)]