feat(greenfield): rebuild SlabUploader M1-M3 on clean foundation, all gates green

Clean re-implementation of the full product (not a port of the old M3 tree):
- P0 foundation: 13-table schema + per-call sqlite factory (thread-safe),
  FastAPI app (health, JSON logging + secret redaction, CORS, startup guard).
- P1 M1 Capture: mask/sheetKeep, geometry/rect (min-area rect), measure,
  png crop/inventory/overlay, EXIF decodeOrientedBitmap.
- P2 M2 Photos: stateful capture session (batch, pick-cal, apply mask/crop
  to batch) + photos-ready lineup.
- P3 M3 Create: real backend (crypto, woo client, taxonomy sync, pricing,
  inference Call1/Call2, review, publish, settings, slabs, photos) + real FE
  review/publish/settings screens consuming the API (no hardcoded Woo ids).
- P4 gate exit: check_requirements + check_coverage both exit 0
  (137/155 IDs, 0 gaps); backend 130/130, frontend 150/150, build green.

Cite: docs/REQUIREMENTS.md (155 rows), docs/MILESTONES.md M1-M3.

frontend/src/review/lineup.ts

@@ -0,0 +1,77 @@
+/**
+ * Review photo-strip lineup (REVIEW-5 / PUBLISH-45). Pure logic so keep/remove,
+ * reorder, and the submission minimum are unit-testable without a browser.
+ *
+ * The owner taps photos to keep/remove and drags to reorder; the LEFTMOST kept
+ * photo is the primary (Woo cover). Submission minimum: at least one clean
+ * calibration photo AND its dimension-overlay copy (REVIEW-5). Batch photos
+ * are optional.
+ */
+
+export type PhotoRole = 'calibration' | 'overlay' | 'batch';
+
+export interface LineupItem {
+  id: string;
+  role: PhotoRole;
+  isCalibration: boolean;
+  /** True = the owner keeps this photo in the submission. */
+  kept: boolean;
+}
+
+/** The kept photos in their current (left→right) order; the first is the primary. */
+export function keptInOrder(items: LineupItem[]): LineupItem[] {
+  return items.filter((it) => it.kept);
+}
+
+/** Move an item from one index to another (drag-reorder). Returns a new array. */
+export function moveItem<T>(arr: T[], from: number, to: number): T[] {
+  if (from === to || from < 0 || to < 0 || from >= arr.length || to >= arr.length) {
+    return arr;
+  }
+  const next = arr.slice();
+  const [item] = next.splice(from, 1);
+  next.splice(to, 0, item);
+  return next;
+}
+
+/**
+ * Whether the kept lineup meets the submission minimum (REVIEW-5): at least one
+ * clean calibration photo and one dimension-overlay copy. Returns the missing
+ * role(s) so the UI can name them in a nudge.
+ */
+export function missingMinimums(items: LineupItem[]): PhotoRole[] {
+  const kept = items.filter((it) => it.kept);
+  const missing: PhotoRole[] = [];
+  if (!kept.some((it) => it.role === 'calibration')) missing.push('calibration');
+  if (!kept.some((it) => it.role === 'overlay')) missing.push('overlay');
+  return missing;
+}
+
+/** True when the kept lineup is publishable from a photo standpoint. */
+export function lineupValid(kept: LineupItem[]): boolean {
+  return missingMinimums(kept).length === 0;
+}
+
+/** A short owner-facing label for a role (used in the minimum nudge). */
+export function roleLabel(role: PhotoRole): string {
+  if (role === 'calibration') return 'a clean photo';
+  if (role === 'overlay') return 'its dimension-overlay copy';
+  return 'a batch photo';
+}
+
+/**
+ * Resolve the <img> src for a strip photo. A fresh in-memory blob must become
+ * a `blob:` object URL — assigning a raw Blob renders a broken image. With no
+ * usable blob, fall back to the stored endpoint.
+ *
+ * Pure + injectable: `createObjectUrl` defaults to `URL.createObjectURL` so it
+ * is unit-testable without a real DOM/Blob.
+ */
+export function resolvePhotoUrl(
+  blob: Blob | null,
+  endpoint: string,
+  createObjectUrl: (b: Blob) => string = (b) => URL.createObjectURL(b),
+): string {
+  if (blob && blob.size > 0) return createObjectUrl(blob);
+  return endpoint;
+}