fix(clip): stop re-sending undecodable files every pass

A 422 from Apollo's /encode_image (bytes it can't decode — corrupt
files, non-images with an image extension) left clip_embedding NULL,
so the drain re-sent the file and logged the same "permanent failure
(will retry next pass)" on every scan.

Permanent rejections now record a clip_failures marker scoped to the
row's content_hash; list_clip_unencoded_candidates skips the row while
the hash still matches, so a replaced file gets another try with no
cleanup. Only 422 (new ClipError::Rejected) marks: other 4xx are
deployment problems (auth, routing) and would otherwise blacklist the
whole library.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/files.rs

@@ -1910,6 +1910,16 @@ mod tests {
             Ok(())
         }
 
+        fn mark_clip_failed(
+            &mut self,
+            _library_id: i32,
+            _rel_path: &str,
+            _content_hash: &str,
+            _error: &str,
+        ) -> Result<(), DbError> {
+            Ok(())
+        }
+
         fn list_clip_index(
             &mut self,
             _library_ids: &[i32],