US02-06: Deliver Workflow, Safety, Library, Analysis, and Stats Views

Ports the safety review and the Photo Analyzer Library/Analyze/Stats
experiences onto the shared API + service layer, and adds the Workflow
home, enforcing the pipeline gates and the one-mutating-job policy.

Backend
- migration 0005 + models: safety_reviews (append-only, latest row is the
  current decision) and analysis_results (donor photos schema re-keyed to
  asset_id).
- SafetyService: persist scores/decisions, review queue with filters, and
  the EXIF safety checkpoint (mutually-exclusive sfw/nsfw keyword written,
  read back, current_sha256 refreshed) that upload eligibility depends on.
- AnalysisService: the privacy gate — the vision provider is called ONLY for
  canonical, confirmed-SFW assets; nsfw/undecided are recorded skipped without
  a request. Provider is an injected adapter (real OpenAI-compatible Gemini
  call extracted from photo_analyzer.analyze_image; a fake in tests).
- LibraryService: Library search + Stats read model ported from webapp/query.py
  (LIKE search in place of FTS5; facets, top tags, years, albums, people).
- WorkflowService + GET /api/v1/workflow: per-stage readiness derived from the
  source tables — counts, blockers, last-run, action, and an active_job that
  drives read-only-during-jobs. Safety scoring and analysis run as durable jobs
  under the library_write lock via new domain handlers, so a second mutating
  job is refused.
- routes: workflow, safety (queue/counts/decisions/jobs), analysis
  (counts/results/jobs), library (assets/facets/stats).

Frontend
- five views (frontend/js/views.js) on the US02-05 shell: Workflow stepper
  (status text+icon, not colour alone; actions disabled with a reason while a
  job runs), Safety review (filter tabs, decide, persists across reload),
  Library (search + cards), Analyze (counts + live job log via the SSE
  adapter), Stats. Shared DOM helpers extracted to dom.js; Workflow is the home
  route.

Tests
- integration: provider-call privacy (nsfw never reaches the provider),
  sfw→nsfw flip drops analysis eligibility, decision persistence, one-mutating-
  job rejection, workflow counts, and the exiftool safety-keyword write/verify.
- e2e: Workflow cards, actions disabled+explained during a job, safety
  decide-persists-across-reload, Library search, Stats, Analyze counts.
- traceability map updated for US02-05 and US02-06.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

photo_pipeline/models/__init__.py

@@ -12,6 +12,7 @@ from photo_pipeline.models.duplicates import (
 )
 from photo_pipeline.models.jobs import Job, JobEvent, JobItem
 from photo_pipeline.models.thumbnails import Thumbnail
+from photo_pipeline.models.workflow import AnalysisResult, SafetyReview
 
 __all__ = [
     "Asset",
@@ -23,4 +24,6 @@ __all__ = [
     "JobItem",
     "JobEvent",
     "Thumbnail",
+    "SafetyReview",
+    "AnalysisResult",
 ]

photo_pipeline/models/workflow.py

@@ -0,0 +1,66 @@
+"""Safety review and content-analysis persistence (US02-06).
+
+Both tables key on the stable ``asset_id``, not a path — the donors used a
+path-keyed ``nsfw_scores.csv`` and a path-keyed ``photos`` table, which broke on
+every move/rename. ``safety_reviews`` is append-only history; the latest row per
+asset is the current decision (the privacy gate reads it). ``analysis_results`` is
+one current row per asset (the donor photos schema re-keyed to asset identity).
+
+Per-stage ``asset_stage_states``/``exif_projections`` from the concept are not
+modelled here: the workflow view derives its counts directly from these source
+tables plus duplicate clusters, which is enough for this story's gates.
+ponytail: add the full stage-state projection when a stage needs history the
+source tables can't reconstruct.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import DateTime, ForeignKey, Integer, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from photo_pipeline.db import Base
+
+
+class SafetyReview(Base):
+    __tablename__ = "safety_reviews"
+
+    id: Mapped[str] = mapped_column(String, primary_key=True)
+    asset_id: Mapped[str] = mapped_column(ForeignKey("assets.id"), nullable=False, index=True)
+    # score without decision = scored-but-unreviewed; decision without score = manual.
+    score: Mapped[float | None] = mapped_column()
+    decision: Mapped[str | None] = mapped_column(String)  # sfw | nsfw | deferred
+    prior_decision: Mapped[str | None] = mapped_column(String)
+    reviewer: Mapped[str | None] = mapped_column(String)
+    # Set once the mutually-exclusive safety keyword is written to EXIF and read
+    # back — upload eligibility depends on this verified checkpoint.
+    exif_verified_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    result_sha256: Mapped[str | None] = mapped_column(String)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+
+
+class AnalysisResult(Base):
+    __tablename__ = "analysis_results"
+
+    asset_id: Mapped[str] = mapped_column(ForeignKey("assets.id"), primary_key=True)
+    # pending | analyzed | error | skipped_nsfw
+    status: Mapped[str] = mapped_column(String, nullable=False, default="pending")
+    description: Mapped[str | None] = mapped_column(String)
+    tags: Mapped[str | None] = mapped_column(String)  # JSON array string (donor shape)
+    people_count: Mapped[int | None] = mapped_column(Integer)
+    setting: Mapped[str | None] = mapped_column(String)
+    time_of_day: Mapped[str | None] = mapped_column(String)
+    season: Mapped[str | None] = mapped_column(String)
+    mood: Mapped[str | None] = mapped_column(String)
+    location_hint: Mapped[str | None] = mapped_column(String)
+    approx_year: Mapped[int | None] = mapped_column(Integer)
+    model: Mapped[str | None] = mapped_column(String)
+    prompt_version: Mapped[str | None] = mapped_column(String)
+    tokens_total: Mapped[int | None] = mapped_column(Integer)
+    raw_response: Mapped[str | None] = mapped_column(String)
+    error_message: Mapped[str | None] = mapped_column(String)
+    analyzed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    exif_written_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))