feat(system-tags): process vs chrome groups + WIP provisional auto-apply (#1464)

Backend for the system-tag behavior refactor (milestone #157). editor screenshot
moves from chrome (hidden) to the PROCESS group (shown, like wip); wip+editor gain
provisional auto-apply so they stop needing endless manual identification —
without a runaway loop.

- tag.py: split PRESENTATION_SYSTEM_TAGS → CHROME_SYSTEM_TAGS (banner) +
  PROCESS_SYSTEM_TAGS (wip, editor screenshot).
- heads.py: generalize presentation_auto_apply_sweep → system_tag_auto_apply_sweep
  (mode chrome|process). Same Guard 1 (skip human/confirmed) + Guard 2 (ring-loud
  conflict → PresentationReview). process mode uses source 'process_auto' and does
  NOT hide (hide is a gallery-query effect of group membership).
- training_data._AUTO_SOURCES += 'process_auto' → the head never trains on its own
  auto-applied output; only wip_title/manual train it (the runaway break).
- ml_settings: process_auto_apply_enabled (OFF, opt-in) + threshold + conflict
  threshold. presentation_review.mode ('chrome'|'process'). Migration 0086.
- gallery_service: default-hide reads CHROME only (editor now shows); Explore
  neighbors exclude the whole PROCESS group.
- tasks/ml + celery beat: scheduled_process_auto_apply (daily, opt-in); prune
  covers both modes.
- api: ml_admin process_* CRUD+validation; hidden-review returns mode.
- tests: rename chrome sweep calls; new test_process_auto_apply (apply, guards,
  mode flag, no-self-train); gallery test asserts editor now visible.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/app/api/gallery.py

@@ -236,8 +236,10 @@ async def jump():
 #    content", surfaced in the gallery's Show-hidden review strip. -----------
 @gallery_bp.route("/hidden-review", methods=["GET"])
 async def hidden_review():
-    """Unresolved presentation auto-hide flags, most-concerning first (highest
-    content score) — for the gallery's Hidden-view review strip."""
+    """Unresolved system-tag auto-apply review flags (chrome + process, #1464),
+    most-concerning first (highest content score) — for the review strip. `mode`
+    tells the client whether the flagged tag hid the image ('chrome') or left it
+    visible ('process'), which decides the resolve labels (un-hide vs remove-tag)."""
     ptag = aliased(Tag)
     ctag = aliased(Tag)
     async with get_session() as session:
@@ -247,6 +249,7 @@ async def hidden_review():
                 PresentationReview.tag_id,
                 PresentationReview.conflict_tag_id,
                 PresentationReview.conflict_score,
+                PresentationReview.mode,
                 ImageRecord.path, ImageRecord.thumbnail_path,
                 ImageRecord.sha256, ImageRecord.mime,
                 ptag.name.label("tag_name"),
@@ -266,6 +269,7 @@ async def hidden_review():
             "conflict_tag_id": r.conflict_tag_id,
             "conflict_name": r.conflict_name,
             "conflict_score": r.conflict_score,
+            "mode": r.mode,
             "thumbnail_url": thumbnail_url(r.thumbnail_path, r.sha256, r.mime),
             "image_url": image_url(r.path),
         }