feat(photos): separate object storage from metadata layer

Move physical file facts out of the photos table into an objects ledger:

- objects / photo_objects / variant_jobs tables (migration 000008)
- drop storage_key/thumb_key/preview_key/size/width/height/mime_type from
  photos (migration 000009); they are derived via joins to the original object
- album-free storage keys: objects/{id}/{role}.{ext}
- explicit GC via pending/ready/deleting states; objects deleted only when no
  photo references them
- background worker drives variant generation (durable variant_jobs) and GC
- copy/move are metadata-only; storage objects are shared between photos
- remove unused storage.DeletePrefix

Non-destructive to the external JSON API: size/dimensions/mime and URLs are
still returned, just sourced from the object layer.

OpenSpec change: media-object-layer

backend/internal/config/config.go

@@ -48,12 +48,19 @@ type SSE struct {
 	ClientBuffer      int
 }
 
+type Worker struct {
+	Interval   time.Duration
+	Batch      int
+	PendingTTL time.Duration
+}
+
 type Config struct {
 	Postgres Postgres
 	S3       S3
 	Auth     Auth
 	Server   Server
 	SSE      SSE
+	Worker   Worker
 }
 
 func Load() (*Config, error) {
@@ -92,6 +99,21 @@ func Load() (*Config, error) {
 		return nil, fmt.Errorf("invalid S3_USE_PATH_STYLE: %w", err)
 	}
 
+	workerInterval, err := time.ParseDuration(getEnv("WORKER_INTERVAL", "5s"))
+	if err != nil {
+		return nil, fmt.Errorf("invalid WORKER_INTERVAL: %w", err)
+	}
+
+	workerBatch, err := strconv.Atoi(getEnv("WORKER_BATCH", "10"))
+	if err != nil {
+		return nil, fmt.Errorf("invalid WORKER_BATCH: %w", err)
+	}
+
+	workerPendingTTL, err := time.ParseDuration(getEnv("WORKER_PENDING_TTL", "10m"))
+	if err != nil {
+		return nil, fmt.Errorf("invalid WORKER_PENDING_TTL: %w", err)
+	}
+
 	cfg := &Config{
 		Postgres: Postgres{
 			Host:     getEnv("PG_HOST", "pg.localnet"),
@@ -124,6 +146,11 @@ func Load() (*Config, error) {
 			HeartbeatInterval: heartbeat,
 			ClientBuffer:      bufSize,
 		},
+		Worker: Worker{
+			Interval:   workerInterval,
+			Batch:      workerBatch,
+			PendingTTL: workerPendingTTL,
+		},
 	}
 
 	if cfg.Auth.JWTSecret == "" {