refactor(ml): retire the Camie tagger + allowlist bulk-apply (#1189)

Heads + CCIP are the tag source and head auto-apply is the earned propagation.
The Camie tagger ran only to feed the allowlist bulk-apply (its ImagePrediction
rows had no other consumer), and the allowlist was a SECOND, un-earned auto-apply
path firing in parallel with heads on every accept — exactly the un-earned spray
the v2 pivot replaced. Retire both.

Behavior change: accepting a suggestion now applies the tag to THAT image only
(source='ml_accepted', a head-training positive) — it no longer allowlists +
fans the tag across the library via Camie. Propagation is heads' earned
auto-apply. (Loses instant cold-start propagation for booru-vocab tags; that was
un-earned and bypassed the precision gate.)

- tag_and_embed is now EMBED-ONLY (no Camie load/infer, no ImagePrediction
  writes); backfill enqueues it for images with no embedding.
- Removed: services/ml/tagger.py, apply_allowlist_tags + helpers + daily beat +
  every enqueue caller (accept/alias/merge/per-image), api/allowlist.py +
  blueprint, ImagePrediction + TagAllowlist models/tables (migration 0067),
  AllowlistTable.vue + allowlist store, the accept coverage-projection payload.
- AllowlistService gutted to accept/dismiss/undismiss/reject (the rejection store
  the rail still needs); accept returns nothing, API returns {accepted, tag_id}.
- tag merge no longer repoints/triggers the allowlist; _keep_as_alias now keys on
  ML-applied image_tag sources (incl. head_auto) instead of the allowlist.
- UI: MLBackfillCard relabelled to embedding-only; accept toast simplified;
  MaintenancePanel drops the allowlist tile.

Left for a follow-up hygiene pass (now-inert, harmless): the dead settings
columns (tagger_store_floor, tagger_model_version, suggestion_threshold_*,
video_min_tag_frames), image_record.tagger_model_version, MLThresholdSliders
trim, and the Camie model download in download_models.py.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ttrj5P7upUTueSfoJcxEqa

tests/test_migration_0003.py

@@ -5,14 +5,12 @@ from backend.app.models import (
     ImageRecord,
     MLSettings,
     TagAlias,
-    TagAllowlist,
     TagSuggestionRejection,
 )
 
 
 def test_new_tables_registered():
     expected = {
-        "tag_allowlist",
         "tag_suggestion_rejection",
         "tag_alias",
         "ml_settings",
@@ -40,11 +38,6 @@ def test_ml_settings_singleton_constraint():
     assert "ck_ml_settings_singleton" in names
 
 
-def test_tag_allowlist_confidence_check():
-    names = {c.name for c in TagAllowlist.__table__.constraints}
-    assert "ck_tag_allowlist_confidence_range" in names
-
-
 def test_tag_suggestion_rejection_pk():
     pk_cols = {c.name for c in TagSuggestionRejection.__table__.primary_key.columns}
     assert pk_cols == {"image_record_id", "tag_id"}