Seed-packet capture: vision model, extraction, catalog match, create (backend) (#81)

Photograph a seed packet → it fills in the plant and the purchase. This is the
backend; the scan UI is a follow-up PR.

Vision model config (mirrors the agent model from #79):
- Migration 0011 adds instance_settings.vision_model; PANSY_VISION_MODEL is the
  env default. Precedence Settings → env → empty; the KEY stays in the env.
- EffectiveVision resolves it; /capabilities advertises "vision" only when a
  model + key are configured, so the UI offers the scan button only when it works.

Extraction is one-shot, NOT an agent loop (internal/vision):
- majordomo.Generate[SeedPacket] derives a JSON schema from the struct tags and
  hands the image to the vision model; it can't call a tool, so it can't touch
  the garden — it only reads a picture and returns data. Numeric fields are
  pointers, so a field the packet doesn't print comes back nil, not a made-up 0.
- Hermetic test: majordomo's fake provider returns canned packet JSON and
  Generate unmarshals it, image + derived schema included. No live model.

The image is normalized to JPEG at the upload boundary (imagenorm from #80),
which is where an iPhone HEIC becomes readable — majordomo's media path can't
decode HEIC. imagenorm now links into the binary (~7 MB, the cost #80 deferred).

The hard part is catalog matching, not OCR (internal/service/seed_packet.go):
- A wrong auto-match splits a variety's seed-lot history across duplicate rows,
  so the service NEVER auto-creates. matchPlants surfaces RANKED candidates
  (exact name → variety-in-name → same species, conservative and name-based),
  the user confirms, and CreateFromPacket makes the plant (new or existing) + the
  lot. Exactly one of plantId/newPlant, refused otherwise.
- Plants/lots aren't in the undo history (catalog/inventory), so no change set.
- The extractor is injectable (service.WithPacketExtractor) so ExtractSeedPacket
  and the /scan endpoint test end to end against a fake, no live model.

Endpoints: POST /seed-lots/scan (multipart image → proposal, reads only; extends
the read deadline for a slow phone upload, caps the body, maps too-large/unreadable
to clear statuses) and POST /seed-lots/from-packet (confirmed proposal → 201).

Docs: README (PANSY_VISION_MODEL), DESIGN (routes + the decision and why the
model can't touch the garden).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

internal/api/settings.go

@@ -51,6 +51,10 @@ type effectiveView struct {
 	// can be false even when Enabled+HasApiKey are true (an unresolvable model),
 	// which is exactly the case the UI needs to surface.
 	AgentLive bool `json:"agentLive"`
+	// VisionModel is the resolved seed-packet model (DB-over-env). VisionReady is
+	// whether capture can actually be offered (a key and a model).
+	VisionModel string `json:"visionModel"`
+	VisionReady bool   `json:"visionReady"`
 }
 
 // settingsPayload builds the response, or an error. It does NOT swallow an
@@ -64,13 +68,19 @@ func (h *handlers) settingsPayload(c *gin.Context, st *domain.InstanceSettings)
 	if err != nil {
 		return settingsResponse{}, err
 	}
+	vis, err := h.svc.EffectiveVision(c.Request.Context())
+	if err != nil {
+		return settingsResponse{}, err
+	}
 	return settingsResponse{
 		Settings: st,
 		Effective: effectiveView{
-			Model:     eff.Model,
-			Enabled:   eff.Enabled,
-			HasApiKey: eff.APIKey != "",
-			AgentLive: h.agent.get() != nil,
+			Model:       eff.Model,
+			Enabled:     eff.Enabled,
+			HasApiKey:   eff.APIKey != "",
+			AgentLive:   h.agent.get() != nil,
+			VisionModel: vis.Model,
+			VisionReady: vis.Ready(),
 		},
 	}, nil
 }
@@ -95,6 +105,7 @@ func (h *handlers) getSettings(c *gin.Context) {
 type settingsUpdateRequest struct {
 	AgentModel   string          `json:"agentModel"`
 	AgentEnabled json.RawMessage `json:"agentEnabled"`
+	VisionModel  string          `json:"visionModel"`
 	Version      int64           `json:"version" binding:"required"`
 }
 
@@ -117,6 +128,7 @@ func (h *handlers) updateSettings(c *gin.Context) {
 	st, err := h.svc.UpdateInstanceSettings(c.Request.Context(), mustActor(c).ID, service.InstanceSettingsPatch{
 		AgentModel:   req.AgentModel,
 		AgentEnabled: enabled,
+		VisionModel:  req.VisionModel,
 		Version:      req.Version,
 	})
 	if err != nil {