fix(tags): fandom views aggregate images via their characters

A fandom owns characters via Tag.fandom_id, but every image<->tag query
went purely through direct image_tag rows, so a fandom only surfaced
images literally tagged with it — images carrying one of its characters
were invisible to its browse count, previews, and gallery filter.

Derive membership at query time instead of materializing fandom rows
(which would drift on every reassign/merge/remove). Add one shared
predicate in tag_query.py — image_in_tag_scope / image_in_any_tag_scope:
an image belongs to a tag if tagged with it directly OR (when the tag is
a fandom) carrying a character whose fandom_id is that tag. The character
leg is empty for non-fandom tags, so it applies uniformly with no kind
branching. Route all read sites through it:

- gallery _apply_scope: include, OR-groups, and symmetric exclude
- directory image_count: correlated COUNT(DISTINCT) scalar subquery
- directory previews: UNION direct + via-character, then ROW_NUMBER<=3
- cleanup count_tag_associations: Tier-B delete prompt now reports a
  fandom's true blast radius (was 0 for fandoms with no direct rows)

find_unused_tags already protected fandoms via used_via_fandom; left as is.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_cleanup_service.py

@@ -146,6 +146,27 @@ def test_count_tag_associations_counts_image_tag_rows(db_sync, tmp_path):
     assert cleanup_service.count_tag_associations(db_sync, tag_id=tag.id) == 1
 
 
+def test_count_tag_associations_fandom_includes_character_images(db_sync, tmp_path):
+    # Deleting a fandom affects images carrying its characters too, so the
+    # Tier-B blast-radius prompt must count them — not just direct image_tag
+    # rows on the fandom (a fandom usually has zero of those). DISTINCT: an
+    # image with both the fandom and its character counts once.
+    a = _make_artist(db_sync, slug="fc")
+    img0 = _make_image(db_sync, artist=a, path=str(tmp_path / "0.jpg"), sha256="e" * 64)
+    img1 = _make_image(db_sync, artist=a, path=str(tmp_path / "1.jpg"), sha256="f" * 64)
+    fandom = _make_tag(db_sync, name="Creux", kind=TagKind.fandom)
+    char = _make_tag(db_sync, name="OcChar", kind=TagKind.character)
+    char.fandom_id = fandom.id
+    db_sync.flush()
+    db_sync.execute(image_tag.insert().values([
+        {"image_record_id": img0.id, "tag_id": char.id},
+        {"image_record_id": img1.id, "tag_id": char.id},
+        {"image_record_id": img1.id, "tag_id": fandom.id},
+    ]))
+    db_sync.commit()
+    assert cleanup_service.count_tag_associations(db_sync, tag_id=fandom.id) == 2
+
+
 def test_find_unused_tags_returns_only_unreferenced(db_sync, tmp_path):
     a = _make_artist(db_sync, slug="fu")
     img = _make_image(