refactor: drop AI/vision pipeline + plain Postgres + full-refresh script

Removes the OpenCLIP-on-ONNX classifier and everything that fed or
consumed it:
  - backend: app/services/vision/, app/tasks/vision.py,
    app/services/feature_flags.py, app/routers/features.py — all
    deleted; admin AI/feature-flag endpoints and the worker-vision
    bootstrap call gone. Photo.needs_review and its index dropped.
  - frontend: AI Settings tab, useFeaturesQuery hook, FeatureFlag
    types, "Needs Review" sidebar entry + filter, needs_review filter
    URL param all gone.
  - infra: worker-vision compose service + models_data volume deleted;
    worker-light command no longer runs bootstrap_models; the db
    image switches from pgvector/pgvector:pg16 to postgres:16; backend
    Dockerfile drops the dedicated torch RUN layer; requirements.txt
    drops torch/torchvision/open-clip-torch/onnxruntime.

Alembic 0019_drop_ai_remnants:
  - drops photos.needs_review + ix_photos_needs_review
  - DROP EXTENSION IF EXISTS vector (must run before the image swap;
    the new postgres:16 doesn't ship pgvector)

New scripts/full_refresh.py: one-shot DB ↔ filesystem reconciliation.
Runs cleanup_data_integrity, scans every active SourceRoot inline
(no celery dependency so the worker can be stopped), hard-prunes
photo + folder rows for files that are gone, removes orphan
/data/thumbs/{user}/{photo}/ directories. New helper
prune_orphan_thumbnails in cleanup.py.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/Dockerfile

@@ -23,21 +23,9 @@ RUN apt-get update && apt-get install -y \
 
 WORKDIR /app
 
-# Install PyTorch CPU-only FIRST, in its own layer, so open-clip-torch
-# doesn't pull the full CUDA build (~7 GB). CPU inference is all we need
-# — the heavy lifting happens through ONNX Runtime.
-#
-# Two cache wins here:
-#   1. Its own RUN layer means edits to requirements.txt don't force a
-#      re-pull of the ~200MB torch wheel.
-#   2. The buildkit cache mount keeps pip's download cache on disk
-#      across builds even when the layer itself is invalidated, so a
-#      torch-version bump or a builder cache eviction still reuses the
-#      wheel from local cache instead of re-fetching from pytorch.org.
-RUN --mount=type=cache,target=/root/.cache/pip \
-    pip install torch torchvision --index-url https://download.pytorch.org/whl/cpu
-
 COPY requirements.txt .
+# buildkit cache mount keeps pip's download cache on disk across builds
+# so even when this layer is invalidated, wheels are reused locally.
 RUN --mount=type=cache,target=/root/.cache/pip \
     pip install -r requirements.txt