feat: normalize camera tags for fleet organization

[matteius]

Summary

• introduce stable UUID-backed camera tags with color and description metadata
• normalize camera-to-tag assignments while keeping the existing comma-separated stream field synchronized for compatibility
• backfill legacy tag values idempotently at startup and repair interrupted synchronization
• add admin-only CRUD, merge, and UUID-based camera assignment APIs

API

• GET|POST /api/camera-tags
• GET|PUT|DELETE /api/camera-tags/{tag_uuid}
• POST /api/camera-tags/{source_uuid}/merge
• GET|PUT /api/cameras/{camera_uuid}/tags

Compatibility and safety

• existing stream create/update paths populate normalized assignments
• normalized edits rebuild the legacy tag string so current UI and tag-based authorization continue to work
• case-insensitive duplicate labels are rejected
• assignment and rename operations roll back if the legacy compatibility field would overflow
• tag labels reject commas and control characters because the compatibility representation cannot encode them losslessly

Validation

• release tests: 7/7 passed for streams, locations, location API, camera tags, camera-tag API, auth, and system API
• ASan/UBSan: 2/2 camera-tag database and API suites passed
• 12 focused tag tests cover CRUD, migration/backfill repair, assignment rollback, legacy synchronization, merge, validation, and admin authorization

Stack

• depends on feat: add camera location hierarchy #498 (camera location hierarchy)
• which depends on feat: add stable camera UUIDs #497 (stable camera UUIDs)
• roadmap: docs: define fleet control plane PRD roadmap #496