feat(ml): tag-eval backend — head-vs-centroid learning-curve eval (persisted)

Slice 1 of milestone #114 (tagging v2). Proves the frozen-embedding + trained-
head spine on the operator's own data, reusing the SigLIP embeddings already
stored on image_record — no re-embedding, no GPU.

Per concept: train a logistic-regression HEAD (positives + negatives = explicit
rejections + sampled unlabeled) vs the old single-CENTROID baseline; report
cross-validated precision/recall/AP for both, a LEARNING CURVE (AP/F1 as tagged
positives grow 10→30→100→300), and example image ids (head-would-suggest /
head-doubts-positive) to eyeball.

Persisted so the report SURVIVES navigation (operator-flagged): the run + full
report live in a new tag_eval_run row (mirrors library_audit_run); the admin
card will rehydrate from GET on mount, not transient state.

- models.TagEvalRun + migration 0056; runs on the ml queue (only worker with
  numpy/sklearn) — numpy/sklearn lazy-imported so the API can still enqueue.
- services/ml/tag_eval (compute + start helper, one-running guard), tasks.ml
  .tag_eval_run, api/tag-eval (POST create, GET history light / detail w/ report).
- recover_stalled_tag_eval_runs sweep + retention (keep last 20) + 5-min beat
  (rule 89). scikit-learn added to requirements-ml.
- tests: param normalization + the rehydrate read-path + create/conflict.

Frontend admin card (trigger + render persisted report) follows next.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

requirements-ml.txt

@@ -19,3 +19,10 @@ transformers>=5.8,<6.0
 onnxruntime>=1.26,<2.0
 huggingface-hub>=1.14,<2.0
 opencv-python-headless>=4.13,<5.0
+
+# scikit-learn powers the tag-eval (#1130) head-vs-centroid comparison: logistic
+# regression + cross-validated precision/recall/AP. Battle-tested metrics matter
+# because that eval's whole purpose is producing trustworthy numbers. numpy is
+# left to resolve transitively (torch/transformers/sklearn all pull it) to avoid
+# pinning against their constraints.
+scikit-learn>=1.7,<2.0