feat(review): #90 photo strip — keep/remove, drag-reorder, leftmost=primary, persist

REVIEW-5 / PUBLISH-45: owner edits the stored photo lineup in Review — tap a
card to keep/remove, drag to reorder, leftmost kept photo = primary (Woo
cover). The kept set must contain a clean calibration + its dimension-overlay
copy; publish is blocked until it does.

- backend: role column on slab_photos (schema + idempotent _migrate ALTER),
  role in photo CRUD + new DELETE endpoint, Woo image order by role-rank
  (clean→overlay→batch) per PUBLISH-45
- frontend: Review photo strip (render from listPhotos, keep/remove,
  HTML5 drag-reorder, dynamic PRIMARY badge from .primary class),
  persistLineup() re-seq kept + drop removed before entering Publish
- tests: lineup.ts unit, e2e review-photo-strip.spec, backend role + order

Refs: #90, REVIEW-5, PUBLISH-45

backend/publish.py

@@ -150,9 +150,16 @@ async def publish(slab_id: str) -> dict:
             code, msg, rec = _classify(e)
             return JSONResponse(status_code=502, content=_error(code, msg, {"recoverable": rec}))
     # 4/5. Upload processed PNGs, then POST product.
+    # PUBLISH-45: Woo image order is the photos-ready lineup — clean calibration,
+    # its dimension-overlay copy, then the remaining batch photos. The Review
+    # photo strip stores the owner's keep order (leftmost = primary), so the
+    # overlay (which can sit after a moved batch photo) is re-ordered here by
+    # role rather than by stored seq. Ties fall back to stored seq.
     status = "draft" if _is_uat(slab["sku"]) else _create_status(conn)
     photos = conn.execute(
-        "SELECT id, processed_blob FROM slab_photos WHERE slab_id=? AND processed_blob IS NOT NULL ORDER BY seq",
+        "SELECT id, processed_blob, role FROM slab_photos "
+        "WHERE slab_id=? AND processed_blob IS NOT NULL "
+        "ORDER BY CASE role WHEN 'calibration' THEN 0 WHEN 'overlay' THEN 1 ELSE 2 END, seq",
         (slab_id,),
     ).fetchall()
     uploaded_ids: list[int] = []