Content dedup on both sides, stored checksums, spool-free zips, upload stats

- sha256+crc32 hashed during upload streaming; unique index per album
- duplicate content returns the existing photo (race-safe via 23505)
- client hashes locally (WebCrypto) and skips the transfer entirely for
  content the album already has
- zip downloads stream S3->response directly using the stored crc32;
  pre-hash photos spool once and self-heal (crc via zip, sha via reprocess)
- upload UI: overall progress bar, bytes, live speed, ETA

Cargo.lock

@@ -2562,6 +2562,7 @@ dependencies = [
  "cookie",
  "crc32fast",
  "futures",
+ "hex",
  "image",
  "rand 0.8.7",
  "reqwest",