feat(photos): S3 multipart BLOB storage + original/processed GET + 410 after purge + attach UI

- backend/photos.py: POST /slabs/{id}/photos (multipart original+processed ->
  slab_photos BLOBs, re-upload replaces), GET original/processed (image/png, 410
  once purged), GET list. Cites CAPTURE-95/105/130, PUBLISH-40.
- frontend: create/photos/PhotoAttach.svelte (slab id, original/processed files,
  calibration flag, lineup) + dev toggle.
- tests: 5 photos tests (upload+get both variants, 410 after purge, 404 slab,
  reupload replaces, list).

Verified: pytest 36 passed; gates exit 0; npm build ok; live QA upload->200,
get original/processed->200, purge->410.

backend/app.py

@@ -259,5 +259,8 @@ async def post_taxonomy_sync() -> dict[str, Any]:
 from .slabs import router as slabs_router
 app.include_router(slabs_router)
 
+from .photos import router as photos_router
+app.include_router(photos_router)
+
 # expose for tests
 __all__ = ["app", "__version__"]