feat(greenfield): rebuild SlabUploader M1-M3 on clean foundation, all gates green

Clean re-implementation of the full product (not a port of the old M3 tree):
- P0 foundation: 13-table schema + per-call sqlite factory (thread-safe),
  FastAPI app (health, JSON logging + secret redaction, CORS, startup guard).
- P1 M1 Capture: mask/sheetKeep, geometry/rect (min-area rect), measure,
  png crop/inventory/overlay, EXIF decodeOrientedBitmap.
- P2 M2 Photos: stateful capture session (batch, pick-cal, apply mask/crop
  to batch) + photos-ready lineup.
- P3 M3 Create: real backend (crypto, woo client, taxonomy sync, pricing,
  inference Call1/Call2, review, publish, settings, slabs, photos) + real FE
  review/publish/settings screens consuming the API (no hardcoded Woo ids).
- P4 gate exit: check_requirements + check_coverage both exit 0
  (137/155 IDs, 0 gaps); backend 130/130, frontend 150/150, build green.

Cite: docs/REQUIREMENTS.md (155 rows), docs/MILESTONES.md M1-M3.

frontend/src/review/lineup.test.ts

@@ -0,0 +1,78 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import {
+  keptInOrder,
+  moveItem,
+  missingMinimums,
+  lineupValid,
+  roleLabel,
+  resolvePhotoUrl,
+  type LineupItem,
+} from './lineup';
+
+const p = (id: string, role: LineupItem['role'], kept = true): LineupItem => ({
+  id,
+  role,
+  isCalibration: role === 'calibration',
+  kept,
+});
+
+test('lineup: keptInOrder returns kept photos in their current order', () => {
+  const items = [p('cal', 'calibration'), p('ov', 'overlay', false), p('b1', 'batch')];
+  assert.deepEqual(keptInOrder(items).map((x) => x.id), ['cal', 'b1']);
+});
+
+test('lineup: leftmost kept is the primary', () => {
+  const items = [p('b1', 'batch'), p('cal', 'calibration'), p('ov', 'overlay')];
+  // After a drag the owner re-ordered; primary follows position, not role.
+  assert.equal(keptInOrder(items)[0].id, 'b1');
+});
+
+test('lineup: primary auto-promotes when the leftmost kept is removed', () => {
+  const items = [p('cal', 'calibration', false), p('ov', 'overlay'), p('b1', 'batch')];
+  assert.equal(keptInOrder(items)[0].id, 'ov');
+});
+
+test('lineup: moveItem reorders (drag-to-front) and is a no-op on same index', () => {
+  const a = ['x', 'y', 'z'];
+  assert.deepEqual(moveItem(a, 2, 0), ['z', 'x', 'y']);
+  assert.deepEqual(moveItem(a, 0, 0), ['x', 'y', 'z']);
+  // Out-of-range is a no-op, never throws.
+  assert.deepEqual(moveItem(a, 0, 5), ['x', 'y', 'z']);
+  // Returns a new array, does not mutate the input.
+  const before = a.slice();
+  moveItem(a, 0, 2);
+  assert.deepEqual(a, before);
+});
+
+test('lineup: minimum requires a clean AND an overlay copy (REVIEW-5)', () => {
+  assert.deepEqual(missingMinimums([p('cal', 'calibration'), p('ov', 'overlay')]), []);
+  assert.deepEqual(missingMinimums([p('cal', 'calibration')]), ['overlay']);
+  assert.deepEqual(missingMinimums([p('ov', 'overlay')]), ['calibration']);
+  assert.deepEqual(missingMinimums([p('b1', 'batch')]), ['calibration', 'overlay']);
+  assert.deepEqual(missingMinimums([]), ['calibration', 'overlay']);
+});
+
+test('lineup: batch-only is not valid; cal+overlay+batch is', () => {
+  assert.equal(lineupValid([p('b1', 'batch')]), false);
+  assert.equal(lineupValid([p('cal', 'calibration'), p('ov', 'overlay'), p('b1', 'batch')]), true);
+});
+
+test('lineup: missingMinimums only counts KEPT photos', () => {
+  // Both roles present in the array, but the cal is not kept.
+  assert.deepEqual(missingMinimums([p('cal', 'calibration', false), p('ov', 'overlay')]), ['calibration']);
+});
+
+test('lineup: roleLabel is owner-facing', () => {
+  assert.match(roleLabel('calibration'), /clean/);
+  assert.match(roleLabel('overlay'), /overlay/);
+});
+
+test('lineup: resolvePhotoUrl turns an in-memory blob into a blob: URL', () => {
+  const blob = new Blob(['png-bytes'], { type: 'image/png' });
+  const fake = (b: Blob) => `blob:fake-${b.size}`;
+  assert.equal(resolvePhotoUrl(blob, '/api/endpoints/photo', fake), 'blob:fake-9');
+  // Empty/absent blob falls back to the stored endpoint.
+  assert.equal(resolvePhotoUrl(new Blob(), '/api/endpoints/photo', fake), '/api/endpoints/photo');
+  assert.equal(resolvePhotoUrl(null, '/api/endpoints/photo', fake), '/api/endpoints/photo');
+});