fix(audit-g5b): race-poisoning in three find-or-create sites

Audit 2026-06-02 flagged three SELECT-then-INSERT sites that lost the
race under concurrent writers / recovery-sweep replays, poisoning the
outer transaction with an unrecoverable IntegrityError and crashing
the calling task. Same shape as the banked 2026-05-26 ImageProvenance
incident (see reference_scalar_one_or_none_duplicates memory).

Mirrors the importer._get_or_create pattern in all three: savepoint
via begin_nested + IntegrityError rollback to that savepoint + re-
SELECT to grab the row the other worker committed first.

- importer._capture_attachment: PostAttachment.sha256 UNIQUE. attachments.store
  is sha-addressed so both workers race to write the same on-disk path
  (shutil.copy2 + rename is idempotent), so no extra cleanup needed.

- TagService.find_or_create: partial uniqueness index on
  (name, kind, COALESCE(fandom_id, -1)). The previous docstring
  claimed "INSERT ... ON CONFLICT" but the implementation was
  SELECT-then-INSERT with no recovery.

- ArtistService.find_or_create: already had IntegrityError handling
  but did session.rollback() (unwinds the WHOLE transaction); now
  uses begin_nested + sp.rollback() so the surrounding request's
  progress isn't lost.

backend/app/services/importer.py

@@ -374,10 +374,19 @@ class Importer:
             artist = self._resolve_artist(source)
             post = self._post_for_sidecar(source, artist)
         sha = _sha256_of(source)
-        existing = self.session.execute(
-            select(PostAttachment).where(PostAttachment.sha256 == sha)
-        ).scalar_one_or_none()
-        if existing is None:
+        select_existing = select(PostAttachment).where(PostAttachment.sha256 == sha)
+        existing = self.session.execute(select_existing).scalar_one_or_none()
+        if existing is not None:
+            self.session.commit()
+            return ImportResult(status="attached")
+        # Savepoint + IntegrityError recovery — PostAttachment.sha256 is
+        # UNIQUE, so two workers can both pass the SELECT and only the
+        # second INSERT fails. Without savepoint, the outer transaction
+        # poisons and the calling task crashes. attachments.store is
+        # sha-addressed so both workers race to write the same target
+        # path; shutil.copy2 + rename is idempotent. Audit 2026-06-02.
+        sp = self.session.begin_nested()
+        try:
             stored = self.attachments.store(source, sha)
             self.session.add(PostAttachment(
                 post_id=post.id if post else None,
@@ -390,6 +399,11 @@ class Importer:
                 size_bytes=source.stat().st_size,
             ))
             self.session.flush()
+            sp.commit()
+        except IntegrityError:
+            sp.rollback()
+            # Lost the race — the other worker's row is canonical.
+            self.session.execute(select_existing).scalar_one()
         self.session.commit()
         return ImportResult(status="attached")