feat(api): background image embedding indexer service

[lstein]

Summary

Stacked on #34 (PR 2 of the Image Map stack). Adds the worker that keeps the embedding index current:

• ImageIndexService: daemon worker thread fed by the image service's on_changed/on_deleted callbacks (enqueue-only — they fire synchronously on the generation thread) plus a startup backfill over unembedded gallery images.
• Encoding: via the configured CLIP Vision or SigLIP model (image_index_model, default clip-vit-large-patch14). On GPU, the model loads through the shared model cache and indexing pauses while a generation is in progress. image_index_device: cpu keeps a service-local CPU copy instead — zero VRAM contention.
• Resilience (from adversarial review): image processors fall back to library defaults when the model dir ships no preprocessor_config.json (true of InvokeAI-published CLIP Vision models — same convention as IP-Adapter/FLUX); inputs are converted to the cached model's dtype (fp16 on GPU); transient failures are retried up to 3× with backoff before an image is marked failed; the dedup set is released in a finally so no image can get stuck unindexable; stop() logs if the worker doesn't join; double-start() is guarded.
• Config: image_index_enabled (default off), image_index_model, image_index_device, image_index_batch_size.
• Events: image_index_status (aggregate counts) — routed to the admin room only, since the counts aggregate over all users' images.
• Changing the configured model discards embeddings from the previous model.

An adversarial review of this diff was run; both critical findings (broken processor loading on stock models, GPU dtype mismatch) plus the retry/poisoning, _pending-leak, and event-privacy findings are fixed above. Remaining accepted trade-offs: CPU mode holds its model copy in RAM while the service lives; image_index_device values other than cpu defer to the model cache (documented in the config description).

Testing

10 service tests with an injected fake encoder (CI never loads models): backfill with eligibility filtering, callback-driven indexing, unloadable-image skip, transient-failure retry-to-success, bad-output batch failure, processor-fallback, status events, clean stop.

🤖 Generated with Claude Code