feat(photos): separate object storage from metadata layer

Move physical file facts out of the photos table into an objects ledger:

- objects / photo_objects / variant_jobs tables (migration 000008)
- drop storage_key/thumb_key/preview_key/size/width/height/mime_type from
  photos (migration 000009); they are derived via joins to the original object
- album-free storage keys: objects/{id}/{role}.{ext}
- explicit GC via pending/ready/deleting states; objects deleted only when no
  photo references them
- background worker drives variant generation (durable variant_jobs) and GC
- copy/move are metadata-only; storage objects are shared between photos
- remove unused storage.DeletePrefix

Non-destructive to the external JSON API: size/dimensions/mime and URLs are
still returned, just sourced from the object layer.

OpenSpec change: media-object-layer

backend/internal/photos/keys_test.go

@@ -0,0 +1,32 @@
+package photos
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestObjectKeyIsAlbumFree(t *testing.T) {
+	cases := []struct {
+		name string
+		id   string
+		role string
+		ext  string
+		want string
+	}{
+		{"original with dot", "obj1", RoleOriginal, ".jpg", "objects/obj1/original.jpg"},
+		{"thumb without dot", "obj1", RoleThumb, "webp", "objects/obj1/thumb.webp"},
+		{"preview", "obj2", RolePreview, ".webp", "objects/obj2/preview.webp"},
+		{"empty ext", "obj3", RoleOriginal, "", "objects/obj3/original"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := objectKey(tc.id, tc.role, tc.ext)
+			if got != tc.want {
+				t.Fatalf("objectKey = %q, want %q", got, tc.want)
+			}
+			if strings.Contains(got, "album") {
+				t.Fatalf("key must not encode an album entity: %q", got)
+			}
+		})
+	}
+}