feat(review): #90 photo strip — keep/remove, drag-reorder, leftmost=primary, persist

REVIEW-5 / PUBLISH-45: owner edits the stored photo lineup in Review — tap a
card to keep/remove, drag to reorder, leftmost kept photo = primary (Woo
cover). The kept set must contain a clean calibration + its dimension-overlay
copy; publish is blocked until it does.

- backend: role column on slab_photos (schema + idempotent _migrate ALTER),
  role in photo CRUD + new DELETE endpoint, Woo image order by role-rank
  (clean→overlay→batch) per PUBLISH-45
- frontend: Review photo strip (render from listPhotos, keep/remove,
  HTML5 drag-reorder, dynamic PRIMARY badge from .primary class),
  persistLineup() re-seq kept + drop removed before entering Publish
- tests: lineup.ts unit, e2e review-photo-strip.spec, backend role + order

Refs: #90, REVIEW-5, PUBLISH-45

backend/tests/test_photos_api.py

@@ -34,13 +34,16 @@ PNG_ORIG = b"\x89PNG-orig-bytes"
 PNG_PROC = b"\x89PNG-proc-bytes"
 
 
-def _multipart(client, slab_id, photo_id, original=PNG_ORIG, processed=PNG_PROC, is_calibration=0):
+def _multipart(client, slab_id, photo_id, original=PNG_ORIG, processed=PNG_PROC, is_calibration=0, role="batch", seq=None):
     files = {"original": ("orig.png", original, "image/png")}
     if processed is not None:
         files["processed"] = ("proc.png", processed, "image/png")
+    data = {"photo_id": photo_id, "is_calibration": str(is_calibration), "role": role}
+    if seq is not None:
+        data["seq"] = str(seq)
     return client.post(
         f"/api/v1/slabs/{slab_id}/photos",
-        data={"photo_id": photo_id, "is_calibration": str(is_calibration)},
+        data=data,
         files=files,
     )
 
@@ -90,9 +93,43 @@ def test_reupload_replaces(photos_env):
 
 def test_list_photos(photos_env):
     client, _ = photos_env
-    _multipart(client, "s1", "pa", is_calibration=1)
-    _multipart(client, "s1", "pb")
+    _multipart(client, "s1", "pa", is_calibration=1, role="calibration")
+    _multipart(client, "s1", "pb", role="overlay")
     r = client.get("/api/v1/slabs/s1/photos")
     assert r.status_code == 200
     ids = [row["id"] for row in r.json()]
     assert "pa" in ids and "pb" in ids
+
+
+def test_upload_stores_and_returns_role(photos_env):
+    client, _ = photos_env
+    r = _multipart(client, "s1", "r1", role="overlay")
+    assert r.status_code == 201
+    assert r.json()["role"] == "overlay"
+    r = client.get("/api/v1/slabs/s1/photos")
+    row = {row_["id"]: row_ for row_ in r.json()}["r1"]
+    assert row["role"] == "overlay"
+
+
+def test_upload_rejects_bad_role(photos_env):
+    client, _ = photos_env
+    r = _multipart(client, "s1", "r2", role="not-a-role")
+    assert r.status_code == 400
+    assert r.json()["error"]["code"] == "validation"
+
+
+def test_delete_photo(photos_env):
+    client, _ = photos_env
+    _multipart(client, "s1", "d1")
+    assert client.get("/api/v1/slabs/s1/photos/d1/processed").status_code == 200
+    r = client.delete("/api/v1/slabs/s1/photos/d1")
+    assert r.status_code == 204
+    # Gone from the list and blob no longer served.
+    ids = [row["id"] for row in client.get("/api/v1/slabs/s1/photos").json()]
+    assert "d1" not in ids
+    assert client.get("/api/v1/slabs/s1/photos/d1/processed").status_code == 404
+
+
+def test_delete_photo_not_found(photos_env):
+    client, _ = photos_env
+    assert client.delete("/api/v1/slabs/s1/photos/ghost").status_code == 404