fix(clip): stop re-sending undecodable files every pass

A 422 from Apollo's /encode_image (bytes it can't decode — corrupt
files, non-images with an image extension) left clip_embedding NULL,
so the drain re-sent the file and logged the same "permanent failure
(will retry next pass)" on every scan.

Permanent rejections now record a clip_failures marker scoped to the
row's content_hash; list_clip_unencoded_candidates skips the row while
the hash still matches, so a replaced file gets another try with no
cleanup. Only 422 (new ClipError::Rejected) marks: other 4xx are
deployment problems (auth, routing) and would otherwise blacklist the
whole library.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/bin/probe_clip_search.rs

@@ -227,7 +227,7 @@ async fn main() -> anyhow::Result<()> {
                     }
                     let _ = call_start;
                 }
-                Err(ClipError::Permanent(e)) => {
+                Err(ClipError::Rejected(e) | ClipError::Permanent(e)) => {
                     perm_fail += 1;
                     warn!("permanent encode failure for {rel_path}: {e}");
                 }