Add photo content-hash dedup and local↔S3 library sync.

Uploads skip per-gallery duplicates, checksums can be backfilled, and STORAGE_BACKEND plus sync tooling make switching storage backends safe.

photo-api/migrations/0002_photo_checksum.pg.sql

@@ -0,0 +1,8 @@
+-- Content hash of the stored original, for per-gallery duplicate detection on
+-- upload. NULL means "not hashed yet" — rows predating this migration, until
+-- `photo-api backfill-checksums` runs. NULLs are distinct under a unique
+-- index, so those rows never collide with each other.
+-- (No semicolons in these comments: the migration runner splits on them.)
+ALTER TABLE photos_photos ADD COLUMN IF NOT EXISTS checksum varchar(64);
+
+CREATE UNIQUE INDEX IF NOT EXISTS photos_photos_gallery_checksum_idx ON photos_photos (gallery_id, checksum);

photo-api/migrations/0002_photo_checksum.sqlite.sql

@@ -0,0 +1,8 @@
+-- Content hash of the stored original, for per-gallery duplicate detection on
+-- upload. NULL means "not hashed yet" — rows predating this migration, until
+-- `photo-api backfill-checksums` runs. NULLs are distinct under a unique
+-- index, so those rows never collide with each other.
+-- (No semicolons in these comments: the migration runner splits on them.)
+ALTER TABLE photos_photos ADD COLUMN checksum text;
+
+CREATE UNIQUE INDEX IF NOT EXISTS photos_photos_gallery_checksum_idx ON photos_photos (gallery_id, checksum);