fix(core,fuse,gui,cli): pair a Pixel raw with its JPEG, and stop refresh timing out

Three things the 12,445-photo library showed that the tests did not.

A Pixel raw capture is two files named after the role each plays —
`PXL_….RAW-01.COVER.jpg` and `PXL_….RAW-02.ORIGINAL.dng` — so their stems differ
and the pairing rule never saw one shot. The marker is now cut off before names
are compared, narrowly: digits, then one role word, so an ordinary name that
happens to contain `.raw-` keeps its stem. Fed the real library's first 40 rows
through the grouping, they collapse to 21 tiles.

A raw that has a JPEG beside it is now painted with that JPEG's thumbnail, which
the server usually already holds. The Raw tab costs no raw download and no raw
decode for those tiles. Raws are found in one batched read, so an ordinary page
pays nothing for the lookup.

Photos could not be moved to Trash at all: they live on the photo volume, which
the mount never holds, so no `nodes` row exists, every authority answered
`Unknown`, and the write check refused the whole library with "trash access: not
allowed". Membership of our own timeline is the authority that does exist for a
photo, and it now answers. An album photo on someone else's volume still fails
closed.

Refreshing the gallery then reported `io: Resource temporarily unavailable (os
error 11)` (B92). The daemon held the control reply until the whole timeline had
been re-read — 63 batches of 200 nodes for this library, minutes of work against
a 120 s read bound. The daemon now answers as soon as the refresh is running,
`PhotosRefreshStatus` reports when it is done, and both front ends follow it: the
gallery reloads the page when it clears, and `pdfs refresh photos` blocks so the
command still means what it says. Each refresh logs its photo count, batch count
and duration.

Released as 1.11.0.

crates/pdfs-cli/src/main.rs

@@ -2277,14 +2277,43 @@ fn cmd_refresh(target: Option<String>) -> Result<()> {
             path: path.unwrap_or("").to_string(),
         },
     };
+    let photos = scope == RefreshScope::Photos;
     match control_request(CtlRequest::Refresh { scope })? {
         CtlResponse::Ok { message } => println!("{message}"),
         CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
         other => bail!("unexpected response: {other:?}"),
     }
+    if photos {
+        wait_for_photos_refresh()?;
+    }
     Ok(())
 }
 
+/// How often [`wait_for_photos_refresh`] asks the daemon whether the timeline
+/// refresh it started is done.
+const PHOTOS_REFRESH_POLL: std::time::Duration = std::time::Duration::from_secs(2);
+
+/// Block until the daemon's timeline refresh has finished.
+///
+/// The daemon answers `Refresh { Photos }` as soon as the refresh is running,
+/// because re-reading a large library takes minutes and a control reply may not.
+/// `pdfs refresh photos` means "the timeline is up to date when I return", so
+/// the waiting happens here, where no socket read bound applies.
+fn wait_for_photos_refresh() -> Result<()> {
+    loop {
+        std::thread::sleep(PHOTOS_REFRESH_POLL);
+        match control_request(CtlRequest::PhotosRefreshStatus)? {
+            CtlResponse::PhotosRefresh { running: true } => continue,
+            CtlResponse::PhotosRefresh { running: false } => {
+                println!("refreshed");
+                return Ok(());
+            }
+            CtlResponse::Error { message, kind } => bail!("{}", cli_error(kind, &message)),
+            other => bail!("unexpected response: {other:?}"),
+        }
+    }
+}
+
 /// Ask for a typed `yes` before an irreversible destroy. Errors (aborting the
 /// command) on anything else, including a non-interactive stdin: a piped or
 /// scripted invocation must not silently wipe the trash.