fix(fe): upload slab photos to the server before publish

ensureServerSlab sent calibration_photo_id at create, but slab_photos rows are
only created by POST /slabs/{id}/photos, which the frontend never called - so
the INSERT hit FOREIGN KEY (calibration_photo_id REFERENCES slab_photos(id))
and every create failed with a generic 400, blocking the whole create->publish
walk.

- stop sending calibration_photo_id at create
- upload every draft photo (original + processed PNG) right after the slab row
  exists, via new review/photoUpload.ts (multipart FormData, same error
  envelope so failures surface through fail(e))
- link calibration_photo_id in the existing review PUT, once the row exists
- extract the role rule into lineup.photoRole() so the review strip and the
  uploader cannot disagree

frontend/src/review/lineup.ts

@@ -18,6 +18,19 @@ export interface LineupItem {
   kept: boolean;
 }
 
+/**
+ * The submission role of a photo: the calibration photo is `calibration`; a
+ * photo carrying its dimension-overlay copy (`processedBlob`) is `overlay`;
+ * everything else is `batch`. Single definition of the role rule — the review
+ * strip (ReviewForm) and the server photo upload (photoUpload) both derive from
+ * this so they can never disagree.
+ */
+export function photoRole(id: string, calibrationPhotoId: string, hasProcessed: boolean): PhotoRole {
+  if (id === calibrationPhotoId) return 'calibration';
+  if (hasProcessed) return 'overlay';
+  return 'batch';
+}
+
 /** The kept photos in their current (left→right) order; the first is the primary. */
 export function keptInOrder(items: LineupItem[]): LineupItem[] {
   return items.filter((it) => it.kept);