feat(review): #90 photo strip — keep/remove, drag-reorder, leftmost=primary, persist

REVIEW-5 / PUBLISH-45: owner edits the stored photo lineup in Review — tap a
card to keep/remove, drag to reorder, leftmost kept photo = primary (Woo
cover). The kept set must contain a clean calibration + its dimension-overlay
copy; publish is blocked until it does.

- backend: role column on slab_photos (schema + idempotent _migrate ALTER),
  role in photo CRUD + new DELETE endpoint, Woo image order by role-rank
  (clean→overlay→batch) per PUBLISH-45
- frontend: Review photo strip (render from listPhotos, keep/remove,
  HTML5 drag-reorder, dynamic PRIMARY badge from .primary class),
  persistLineup() re-seq kept + drop removed before entering Publish
- tests: lineup.ts unit, e2e review-photo-strip.spec, backend role + order

Refs: #90, REVIEW-5, PUBLISH-45

backend/tests/test_photos_api.py

@@ -34,13 +34,16 @@ PNG_ORIG = b"\x89PNG-orig-bytes"
 PNG_PROC = b"\x89PNG-proc-bytes"
 
 
-def _multipart(client, slab_id, photo_id, original=PNG_ORIG, processed=PNG_PROC, is_calibration=0):
+def _multipart(client, slab_id, photo_id, original=PNG_ORIG, processed=PNG_PROC, is_calibration=0, role="batch", seq=None):
     files = {"original": ("orig.png", original, "image/png")}
     if processed is not None:
         files["processed"] = ("proc.png", processed, "image/png")
+    data = {"photo_id": photo_id, "is_calibration": str(is_calibration), "role": role}
+    if seq is not None:
+        data["seq"] = str(seq)
     return client.post(
         f"/api/v1/slabs/{slab_id}/photos",
-        data={"photo_id": photo_id, "is_calibration": str(is_calibration)},
+        data=data,
         files=files,
     )
 
@@ -90,9 +93,43 @@ def test_reupload_replaces(photos_env):
 
 def test_list_photos(photos_env):
     client, _ = photos_env
-    _multipart(client, "s1", "pa", is_calibration=1)
-    _multipart(client, "s1", "pb")
+    _multipart(client, "s1", "pa", is_calibration=1, role="calibration")
+    _multipart(client, "s1", "pb", role="overlay")
     r = client.get("/api/v1/slabs/s1/photos")
     assert r.status_code == 200
     ids = [row["id"] for row in r.json()]
     assert "pa" in ids and "pb" in ids
+
+
+def test_upload_stores_and_returns_role(photos_env):
+    client, _ = photos_env
+    r = _multipart(client, "s1", "r1", role="overlay")
+    assert r.status_code == 201
+    assert r.json()["role"] == "overlay"
+    r = client.get("/api/v1/slabs/s1/photos")
+    row = {row_["id"]: row_ for row_ in r.json()}["r1"]
+    assert row["role"] == "overlay"
+
+
+def test_upload_rejects_bad_role(photos_env):
+    client, _ = photos_env
+    r = _multipart(client, "s1", "r2", role="not-a-role")
+    assert r.status_code == 400
+    assert r.json()["error"]["code"] == "validation"
+
+
+def test_delete_photo(photos_env):
+    client, _ = photos_env
+    _multipart(client, "s1", "d1")
+    assert client.get("/api/v1/slabs/s1/photos/d1/processed").status_code == 200
+    r = client.delete("/api/v1/slabs/s1/photos/d1")
+    assert r.status_code == 204
+    # Gone from the list and blob no longer served.
+    ids = [row["id"] for row in client.get("/api/v1/slabs/s1/photos").json()]
+    assert "d1" not in ids
+    assert client.get("/api/v1/slabs/s1/photos/d1/processed").status_code == 404
+
+
+def test_delete_photo_not_found(photos_env):
+    client, _ = photos_env
+    assert client.delete("/api/v1/slabs/s1/photos/ghost").status_code == 404

backend/tests/test_publish.py

@@ -119,6 +119,53 @@ def test_publish_success(env, monkeypatch):
     assert conn.execute("SELECT processed_blob FROM slab_photos WHERE id='p1'").fetchone()["processed_blob"] is None
 
 
+def test_publish_woo_image_order_by_role(env, monkeypatch):
+    # PUBLISH-45: Woo order is clean cal, dimension-overlay, then batch — by
+    # role, not by stored seq (the Review strip stores the owner's keep order).
+    client, conn = env
+    s = _full_slab()
+    _insert_slab(conn, s)
+    # Stored seq deliberately out of lineup order: batch(1), calibration(2),
+    # overlay(3). The publish query must reorder to cal, overlay, batch.
+    conn.execute("INSERT INTO slab_photos(id,slab_id,seq,is_calibration,role,processed_blob,created_at) VALUES ('pb','s1',1,0,'batch',X'89504E47','t')")
+    conn.execute("INSERT INTO slab_photos(id,slab_id,seq,is_calibration,role,processed_blob,created_at) VALUES ('pc','s1',2,1,'calibration',X'89504E47','t')")
+    conn.execute("INSERT INTO slab_photos(id,slab_id,seq,is_calibration,role,processed_blob,created_at) VALUES ('po','s1',3,0,'overlay',X'89504E47','t')")
+    conn.commit()
+    media_calls = []
+
+    def fake_request(url, method, data, headers):
+        if "/products?sku=" in url:
+            return 200, {}, b"[]"
+        if url.endswith("/wp-json/wp/v2/media") and method == "POST":
+            media_calls.append(data)
+            return 201, {}, json.dumps({"id": 42}).encode()
+        if url.endswith("/wp-json/wc/v3/products") and method == "POST":
+            return 201, {}, json.dumps({"id": 999}).encode()
+        return 200, {}, b"[]"
+
+    from backend.woo import WooClient
+
+    orig_init = WooClient.__init__
+
+    def patched_init(self, *a, **k):
+        orig_init(self, *a, **k)
+        self._request = fake_request
+
+    monkeypatch.setattr(WooClient, "__init__", patched_init)
+    r = client.post("/api/v1/slabs/s1/publish")
+    assert r.status_code == 200, r.text
+    assert len(media_calls) == 3
+    # The photo id is embedded in the multipart filename (slab.py publish
+    # passes f"{sku}-{photo_id}.png"). Order of media uploads = cal, overlay,
+    # batch (PUBLISH-45), not stored seq.
+    def photo_id(body: bytes) -> str:
+        import re
+        m = re.search(rb'filename="[^"]*-(pc|pb|po)\.png"', body)
+        return m.group(1).decode() if m else ""
+
+    assert [photo_id(c) for c in media_calls] == ["pc", "po", "pb"]
+
+
 def test_uat_draft(env, monkeypatch):
     client, conn = env
     s = _full_slab(sku="SLAB-UAT-1")