feat: runtime feature flags, upload/download, RAW decoding

Adds Redis-backed feature flags for vision stages with admin UI toggles
and manual backfill trigger, photo upload and download routers with
frontend upload modal, and rawpy-based RAW decoding with JPEG fallback
for misnamed DNGs. Fixes pgvector serialization, is_trashed filter, and
naive-datetime bind in incremental duplicate regrouping; bumps Celery
time limits on regroup tasks beyond the 5-minute default.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/tasks/thumbs.py

@@ -312,7 +312,25 @@ async def _generate_thumbnails_async(photo_id: str, task):
             else:
                 logger.error(f"Unsupported media type: {photo.media_type}")
                 image = create_placeholder_thumbnail(photo.media_type)
-            
+
+            # Fallback: some files wear a RAW/HEIC extension but are actually
+            # plain JPEGs — e.g. iPhones that write ProRAW-style .DNG for
+            # images where no RAW sensor data was captured, or re-exports
+            # that kept the original suffix. Pillow can open them directly,
+            # so before giving up, try reading the file as a standard image.
+            if not image and photo.media_type in ('raw', 'heic'):
+                try:
+                    image = process_standard_image(photo.filepath)
+                    if image is not None:
+                        logger.info(
+                            f"{photo.filepath}: {photo.media_type} decode failed "
+                            f"but file opens as a standard image — using fallback"
+                        )
+                except Exception as e:
+                    logger.debug(
+                        f"Standard-image fallback failed for {photo.filepath}: {e}"
+                    )
+
             if not image:
                 raise Exception("Failed to process image")
             
@@ -493,7 +511,16 @@ async def _backfill_phashes_async():
     }
 
 
-@shared_task(name='regroup_duplicates')
+@shared_task(
+    name='regroup_duplicates',
+    # Full regroup scales with O(N²) on phash plus one pgvector query per
+    # embedded photo. On a 16k-photo library that's comfortably past the
+    # default 5-minute soft limit — bump to 2h / 2h30m. (Passing None here
+    # does NOT disable limits; Celery falls back to the worker default
+    # of 300s/600s. An explicit number overrides.)
+    soft_time_limit=7200,
+    time_limit=9000,
+)
 def regroup_duplicates_task():
     """Full recompute of duplicate groups (pHash + CLIP similarity).
 
@@ -502,7 +529,15 @@ def regroup_duplicates_task():
     return asyncio.run(regroup_duplicates())
 
 
-@shared_task(name='incremental_regroup_duplicates')
+@shared_task(
+    name='incremental_regroup_duplicates',
+    # O(new × N); still cheaper than a full regroup but can easily exceed
+    # the 5-minute default after a big batch import. Same caveat as
+    # regroup_duplicates above — None would just re-inherit the worker
+    # default, so we pass explicit values.
+    soft_time_limit=3600,
+    time_limit=4200,
+)
 def incremental_regroup_duplicates_task(since_iso: str | None = None):
     """Incremental duplicate detection for newly added photos.