feat(suggestions): visible, reversible rejection in the modal rail

A red-✗ dismissal no longer makes the suggestion vanish. The rejected tag
stays in the rail — dimmed, struck-through, with a "rejected" pill and a
one-click undo (↶) in place of the ✗ — so a misclick is recoverable and the
operator can see what they've said no to (operator-asked 2026-06-27).

Backend: SuggestionService.for_image now KEEPS rejected tags, flagged
rejected=True, sorted to the bottom of their category, instead of dropping
them. New AllowlistService.undismiss + POST /suggestions/undismiss clears the
TagSuggestionRejection. Rejected items are still excluded from bulk consensus
(for_selection) and the type-to-add dropdown, whose jobs are unchanged.

Frontend: store.dismiss flags in place (canonical tags) rather than dropping;
new store.undismiss reverts. SuggestionItem renders the rejected state and
swaps ✗→↶; ✓ still accepts (which clears the rejection server-side).

Tests: rejected-surfaced-flagged-then-reversible (service) + undismiss
endpoint idempotency (API).

Completes #1134's reversible-rejection half. Heads-as-suggestion-source is
the remaining piece.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ttrj5P7upUTueSfoJcxEqa

tests/test_api_suggestions.py

@@ -95,6 +95,25 @@ async def test_dismiss(client, db):
     assert resp.status_code == 204
 
 
+@pytest.mark.asyncio
+async def test_undismiss_reverses_rejection(client, db):
+    img = await _img(db, {})
+    tag = await TagService(db).find_or_create("UndismissMe", TagKind.general)
+    await db.commit()
+    await client.post(
+        f"/api/images/{img.id}/suggestions/dismiss", json={"tag_id": tag.id}
+    )
+    resp = await client.post(
+        f"/api/images/{img.id}/suggestions/undismiss", json={"tag_id": tag.id}
+    )
+    assert resp.status_code == 204
+    # Idempotent: un-rejecting again (nothing to clear) is still a 204.
+    resp2 = await client.post(
+        f"/api/images/{img.id}/suggestions/undismiss", json={"tag_id": tag.id}
+    )
+    assert resp2.status_code == 204
+
+
 @pytest.mark.asyncio
 async def test_alias_requires_fields(client, db):
     img = await _img(db, {})