feat(system-tags): process vs chrome groups + WIP provisional auto-apply (#1464)

Backend for the system-tag behavior refactor (milestone #157). editor screenshot
moves from chrome (hidden) to the PROCESS group (shown, like wip); wip+editor gain
provisional auto-apply so they stop needing endless manual identification —
without a runaway loop.

- tag.py: split PRESENTATION_SYSTEM_TAGS → CHROME_SYSTEM_TAGS (banner) +
  PROCESS_SYSTEM_TAGS (wip, editor screenshot).
- heads.py: generalize presentation_auto_apply_sweep → system_tag_auto_apply_sweep
  (mode chrome|process). Same Guard 1 (skip human/confirmed) + Guard 2 (ring-loud
  conflict → PresentationReview). process mode uses source 'process_auto' and does
  NOT hide (hide is a gallery-query effect of group membership).
- training_data._AUTO_SOURCES += 'process_auto' → the head never trains on its own
  auto-applied output; only wip_title/manual train it (the runaway break).
- ml_settings: process_auto_apply_enabled (OFF, opt-in) + threshold + conflict
  threshold. presentation_review.mode ('chrome'|'process'). Migration 0086.
- gallery_service: default-hide reads CHROME only (editor now shows); Explore
  neighbors exclude the whole PROCESS group.
- tasks/ml + celery beat: scheduled_process_auto_apply (daily, opt-in); prune
  covers both modes.
- api: ml_admin process_* CRUD+validation; hidden-review returns mode.
- tests: rename chrome sweep calls; new test_process_auto_apply (apply, guards,
  mode flag, no-self-train); gallery test asserts editor now visible.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

alembic/versions/0086_process_auto_apply_settings.py

@@ -0,0 +1,61 @@
+"""process auto-apply settings + review mode (#1464) — system-tag refactor
+
+The system-tag behavior refactor gives `wip` / `editor screenshot` (the PROCESS
+group) their own provisional auto-apply, parallel to the presentation (chrome)
+sweep. MLSettings gains three knobs: enabled (OFF by default — a new whole-library
+auto-tagger is opt-in), the flat apply threshold, and the ring-loud conflict
+threshold. presentation_review gains a `mode` column so one review surface serves
+both chrome and process flags (existing rows backfill 'chrome'). server_defaults
+so the existing rows fill cleanly.
+
+Revision ID: 0086
+Revises: 0085
+Create Date: 2026-07-13
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0086"
+down_revision: Union[str, None] = "0085"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "ml_settings",
+        sa.Column(
+            "process_auto_apply_enabled", sa.Boolean(), nullable=False,
+            server_default=sa.text("false"),
+        ),
+    )
+    op.add_column(
+        "ml_settings",
+        sa.Column(
+            "process_auto_apply_threshold", sa.Float(), nullable=False,
+            server_default="0.90",
+        ),
+    )
+    op.add_column(
+        "ml_settings",
+        sa.Column(
+            "process_conflict_threshold", sa.Float(), nullable=False,
+            server_default="0.50",
+        ),
+    )
+    op.add_column(
+        "presentation_review",
+        sa.Column(
+            "mode", sa.String(16), nullable=False,
+            server_default="chrome",
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("presentation_review", "mode")
+    op.drop_column("ml_settings", "process_conflict_threshold")
+    op.drop_column("ml_settings", "process_auto_apply_threshold")
+    op.drop_column("ml_settings", "process_auto_apply_enabled")