feat(fc2b): add /api/images/<id>/suggestions endpoints

GET (ranked, category-grouped), accept (→ apply + allowlist; enqueues
retro-apply when newly added), alias (create alias + accept canonical),
dismiss (per-image rejection). Thin blueprint over SuggestionService +
AllowlistService. Tests marked integration, eager Celery.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_api_suggestions.py

@@ -0,0 +1,89 @@
+import pytest
+
+from backend.app import create_app
+from backend.app.celery_app import celery
+from backend.app.models import ImageRecord, TagKind
+from backend.app.services.tag_service import TagService
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture(autouse=True)
+def eager():
+    celery.conf.task_always_eager = True
+    yield
+    celery.conf.task_always_eager = False
+
+
+@pytest.fixture
+async def app():
+    return create_app()
+
+
+@pytest.fixture
+async def client(app):
+    async with app.test_client() as c:
+        yield c
+
+
+async def _img(db, preds):
+    img = ImageRecord(
+        path="/images/s.jpg", sha256="s" * 64, size_bytes=1,
+        mime="image/jpeg", width=1, height=1,
+        origin="imported_filesystem", integrity_status="unknown",
+        tagger_predictions=preds,
+    )
+    db.add(img)
+    await db.commit()
+    return img
+
+
+@pytest.mark.asyncio
+async def test_get_suggestions(client, db):
+    img = await _img(
+        db, {"sword": {"category": "general", "confidence": 0.97}}
+    )
+    resp = await client.get(f"/api/images/{img.id}/suggestions")
+    assert resp.status_code == 200
+    body = await resp.get_json()
+    assert "general" in body["by_category"]
+
+
+@pytest.mark.asyncio
+async def test_accept_requires_tag_id(client, db):
+    img = await _img(db, {})
+    resp = await client.post(
+        f"/api/images/{img.id}/suggestions/accept", json={}
+    )
+    assert resp.status_code == 400
+
+
+@pytest.mark.asyncio
+async def test_accept_then_applied(client, db):
+    img = await _img(db, {})
+    tag = await TagService(db).find_or_create("AcceptMe", TagKind.character)
+    await db.commit()
+    resp = await client.post(
+        f"/api/images/{img.id}/suggestions/accept", json={"tag_id": tag.id}
+    )
+    assert resp.status_code == 204
+
+
+@pytest.mark.asyncio
+async def test_dismiss(client, db):
+    img = await _img(db, {})
+    tag = await TagService(db).find_or_create("DismissMe", TagKind.general)
+    await db.commit()
+    resp = await client.post(
+        f"/api/images/{img.id}/suggestions/dismiss", json={"tag_id": tag.id}
+    )
+    assert resp.status_code == 204
+
+
+@pytest.mark.asyncio
+async def test_alias_requires_fields(client, db):
+    img = await _img(db, {})
+    resp = await client.post(
+        f"/api/images/{img.id}/suggestions/alias", json={"alias_string": "x"}
+    )
+    assert resp.status_code == 400