feat: tags end-to-end (CRUD, photo membership, filter, sidebar UI)

The Tag model and photo_tags join table were already in place; this
fills in the rest — full backend CRUD, per-photo add/remove, list-
endpoint filtering, and a Tags section in the RightSidebar with
autocomplete-create.

Backend
- routers/tags.py rewritten from a 27-line stub:
    GET    /tags                — list with photo counts
    POST   /tags                — create (idempotent on name)
    PATCH  /tags/{id}           — rename / recolor
    DELETE /tags/{id}           — delete (FK cascades photo_tags)
- routers/photos.py:
    POST   /photos/{id}/tags    — add tag ids (idempotent)
    DELETE /photos/{id}/tags/{tag_id} — remove
    GET    /photos/{id}         — now returns a `tags` list alongside
                                  the existing PhotoResponse fields
                                  (fetched via the photo_tags join)
- list_photos applies the existing tag_ids query param: comma-
  separated, AND semantics, one IN-subquery per id since SQLite
  has no native set-contains-all.

Frontend
- New hooks/useTagsQuery.ts.
- services/api.ts: Tag interface, full tags client (list/create/
  update/delete), addToPhoto/removeFromPhoto helpers.
- filterStore: tagIds: string[] field, setTagIds, toggleTagId,
  hasActiveFilters update, filtersToParams sends tag_ids comma list.
- useFilterUrlSync round-trips ?tag_ids=… so tag-filtered views
  are bookmarkable.
- usePhotosQuery threads tagIds through.
- RightSidebar gains a new Tags section using a TagsEditor
  component:
    - shows existing tag chips with X to remove
    - autocomplete input that matches the user's typing against
      existing tag names
    - shows an inline "+ Create '<name>'" affordance when there's
      no exact match
    - Enter creates and attaches in one shot; Esc clears the input
    - existing colour values render as a tinted chip background
- FilterBar gets a Tags group (only rendered when there's at
  least one tag) with toggleable chips per tag.
- ActiveFilterChips shows "Tag: <name>" chips for each active
  tag id, looking up names lazily from the tags query.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/routers/photos.py

@@ -16,9 +16,10 @@ import logging
 logger = logging.getLogger(__name__)
 
 from app.database import get_db
-from app.models import Photo, Folder, Tag, PhotoTag
+from app.models import Photo, Folder, Tag
 from app.models.folders import SourceRoot
 from app.models.heaps import heap_photos
+from app.models.tags import photo_tags
 from app.schemas.photos import PhotoResponse, PhotoUpdate, PhotoListResponse, BulkAction
 from app.config import settings
 
@@ -120,6 +121,19 @@ async def list_photos(
             )
         )
 
+    # Tag filter — comma-separated tag ids, AND semantics. A photo must
+    # have a row in photo_tags for EVERY listed tag. Implemented as one
+    # subquery per tag id since SQLite doesn't have an efficient
+    # "set-contains-all" operator.
+    if tag_ids:
+        tag_id_list = [t.strip() for t in tag_ids.split(',') if t.strip()]
+        for tid in tag_id_list:
+            filters.append(
+                Photo.id.in_(
+                    select(photo_tags.c.photo_id).where(photo_tags.c.tag_id == tid)
+                )
+            )
+
     # Apply all filters
     if filters:
         query = query.where(and_(*filters))
@@ -153,21 +167,89 @@ async def list_photos(
         pages=(total + per_page - 1) // per_page
     )
 
-@router.get("/{photo_id}", response_model=PhotoResponse)
+@router.get("/{photo_id}")
 async def get_photo(
     photo_id: str,
     db: AsyncSession = Depends(get_db)
 ):
-    """Get single photo with full EXIF and tags"""
+    """Get single photo with full EXIF and its tags."""
     result = await db.execute(
         select(Photo).where(Photo.id == photo_id)
     )
     photo = result.scalar_one_or_none()
-    
+
     if not photo:
         raise HTTPException(status_code=404, detail="Photo not found")
-    
-    return PhotoResponse.from_orm(photo)
+
+    # Fetch tags via the join table so we don't need to declare a
+    # relationship on the Photo model side.
+    tag_result = await db.execute(
+        select(Tag)
+        .join(photo_tags, Tag.id == photo_tags.c.tag_id)
+        .where(photo_tags.c.photo_id == photo_id)
+        .order_by(Tag.name.asc())
+    )
+    tags = tag_result.scalars().all()
+
+    base = PhotoResponse.from_orm(photo).dict()
+    base["tags"] = [
+        {"id": t.id, "name": t.name, "color": t.color} for t in tags
+    ]
+    return base
+
+
+@router.post("/{photo_id}/tags", status_code=201)
+async def add_photo_tags(
+    photo_id: str,
+    body: dict,
+    db: AsyncSession = Depends(get_db),
+):
+    """Add one or more tags to a photo. Body: { tag_ids: [str, ...] }.
+    Idempotent: re-adding existing members is a no-op."""
+    photo_result = await db.execute(select(Photo).where(Photo.id == photo_id))
+    if photo_result.scalar_one_or_none() is None:
+        raise HTTPException(status_code=404, detail="Photo not found")
+
+    tag_ids = body.get("tag_ids") or []
+    if not isinstance(tag_ids, list) or not tag_ids:
+        return {"status": "success", "added": 0}
+
+    existing = await db.execute(
+        select(photo_tags.c.tag_id).where(
+            photo_tags.c.photo_id == photo_id,
+            photo_tags.c.tag_id.in_(tag_ids),
+        )
+    )
+    existing_ids = {row[0] for row in existing.all()}
+    new_ids = [tid for tid in tag_ids if tid not in existing_ids]
+
+    if new_ids:
+        from sqlalchemy import insert
+        await db.execute(
+            insert(photo_tags),
+            [{"photo_id": photo_id, "tag_id": tid} for tid in new_ids],
+        )
+        await db.commit()
+
+    return {"status": "success", "added": len(new_ids)}
+
+
+@router.delete("/{photo_id}/tags/{tag_id}", status_code=204)
+async def remove_photo_tag(
+    photo_id: str,
+    tag_id: str,
+    db: AsyncSession = Depends(get_db),
+):
+    """Remove a tag from a photo. Removing a non-member is a no-op."""
+    from sqlalchemy import delete as sql_delete
+    await db.execute(
+        sql_delete(photo_tags).where(
+            photo_tags.c.photo_id == photo_id,
+            photo_tags.c.tag_id == tag_id,
+        )
+    )
+    await db.commit()
+    return None
 
 @router.get("/{photo_id}/thumb/{size}")
 async def get_thumbnail(