fix(clip): stop re-sending undecodable files every pass

A 422 from Apollo's /encode_image (bytes it can't decode — corrupt
files, non-images with an image extension) left clip_embedding NULL,
so the drain re-sent the file and logged the same "permanent failure
(will retry next pass)" on every scan.

Permanent rejections now record a clip_failures marker scoped to the
row's content_hash; list_clip_unencoded_candidates skips the row while
the hash still matches, so a replaced file gets another try with no
cleanup. Only 422 (new ClipError::Rejected) marks: other 4xx are
deployment problems (auth, routing) and would otherwise blacklist the
whole library.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/clip_search.rs

@@ -172,7 +172,9 @@ pub async fn score_photos(
     // 1. Encode the query text. Fast — Apollo's text encoder is ~50ms on CPU.
     let query_resp = match state.clip_client.encode_text(q_text).await {
         Ok(r) => r,
-        Err(ClipError::Permanent(e)) => return Err(ScoreError::Rejected(e.to_string())),
+        Err(ClipError::Rejected(e) | ClipError::Permanent(e)) => {
+            return Err(ScoreError::Rejected(e.to_string()));
+        }
         Err(ClipError::Transient(e)) => return Err(ScoreError::Unavailable(e.to_string())),
         Err(ClipError::Disabled) => return Err(ScoreError::Disabled),
     };