fix(thumbnails): surface backfill results + tighten validity check

Two coupled problems, operator-flagged 2026-06-01: "missing thumbnails
but triggering backfill found nothing."

1. **Backfill UI was a black box.** `POST /api/thumbnails/backfill`
   returned just `{celery_task_id}` and the admin card said
   "Enqueued." with no counts. There was no way to tell whether the
   scan found 0 candidates, 5000 candidates, or whether the worker
   even picked up the task. "Found nothing" was indistinguishable
   from a broken queue.

   Fix: refactor the scan into a sync helper (`_run_backfill_scan`)
   shared by the Celery task and the API endpoint. The API now runs
   the scan in an executor and returns `{scanned, enqueued, ok,
   regenerated}`. The actual thumbnail generation work still goes
   to the thumbnail Celery queue per row via
   `generate_thumbnail.delay()` — the scan itself is fast
   (SELECT id+thumbnail_path + a file.stat() per row).

2. **`_thumb_is_valid` accepted header-only corrupt files.** The
   magic-byte check passed for any 8-byte file starting with a JPEG
   or PNG header, including empty/truncated/zero-pad files that
   browsers render as broken. Backfill counted these as `ok` and
   never regenerated.

   Fix: also require file size ≥ MIN_THUMB_BYTES (256). Real
   thumbnails are minimum ~2KB even on solid-color sources; header-
   only corrupt files top out around 12 bytes. 256 is well above
   the corrupt floor and well below any legitimate thumbnail.

Plus the admin card now shows the per-run counts instead of
"Enqueued.":
  Scanned 5,432 · enqueued 3 (2 regenerated) · 5,429 ok

tests/test_api_thumbnails.py

@@ -13,8 +13,16 @@ def eager():
 
 
 @pytest.mark.asyncio
-async def test_trigger_thumbnail_backfill(client):
+async def test_trigger_thumbnail_backfill_returns_counts(client):
+    """The API runs the scan synchronously now and returns
+    {scanned, enqueued, ok, regenerated} — operator-flagged 2026-06-01:
+    the previous fire-and-forget shape returned only a celery_task_id,
+    so the admin UI couldn't show whether backfill found 0 or 5000
+    candidates. \"Found nothing\" was indistinguishable from \"the
+    worker isn't picking up the task.\""""
     r = await client.post("/api/thumbnails/backfill")
-    assert r.status_code == 202
+    assert r.status_code == 200
     body = await r.get_json()
-    assert "celery_task_id" in body
+    assert set(body) == {"scanned", "enqueued", "ok", "regenerated"}
+    for key in ("scanned", "enqueued", "ok", "regenerated"):
+        assert isinstance(body[key], int)