fix(photo-approval): resolve group photo lifecycle gaps

[wailbentafat]

Summary

• Unmatched group photos stuck forever: _handle_group_photo now tracks how many approval records were created. If zero faces matched any enrolled user, the photo is auto-approved and made public — same behaviour as the no-faces path.
• Approval timeout: Photos whose users never respond are now unblocked. Added ExpireStaleApprovals SQL query (atomic CTE: marks pending approvals → approved, photo → approved), a PhotoApprovalService.expire_stale() method, and a background task in the FastAPI lifespan that runs the expiry every hour. Timeout defaults to 7 days and is configurable via PHOTO_APPROVAL_TIMEOUT_DAYS in .env.

Files changed

File	Change
app/worker/photo_worker/main.py	Count approvals created; auto-approve if 0
db/queries/photo_approvals.sql	Add ExpireStaleApprovals query
db/generated/photo_approvals.py	Hand-written generated method expire_stale_approvals
app/service/photo_approval.py	Add expire_stale(timeout_days)
app/core/config.py	Add PHOTO_APPROVAL_TIMEOUT_DAYS: int = 7
app/main.py	Start hourly expiry task in lifespan, cancel on shutdown

Test plan

• Lint: make lint — passes
• Types: make check_type — passes (137 files, 0 issues)
• Group photo with no enrolled users → photo becomes approved + public
• Group photo with at least one enrolled user → approval records created, notifications sent, photo stays pending
• After PHOTO_APPROVAL_TIMEOUT_DAYS days, expire_stale marks photos approved