Seed-packet capture: vision model, extraction, catalog match, create (backend) (#81)

Photograph a seed packet → it fills in the plant and the purchase. This is the
backend; the scan UI is a follow-up PR.

Vision model config (mirrors the agent model from #79):
- Migration 0011 adds instance_settings.vision_model; PANSY_VISION_MODEL is the
  env default. Precedence Settings → env → empty; the KEY stays in the env.
- EffectiveVision resolves it; /capabilities advertises "vision" only when a
  model + key are configured, so the UI offers the scan button only when it works.

Extraction is one-shot, NOT an agent loop (internal/vision):
- majordomo.Generate[SeedPacket] derives a JSON schema from the struct tags and
  hands the image to the vision model; it can't call a tool, so it can't touch
  the garden — it only reads a picture and returns data. Numeric fields are
  pointers, so a field the packet doesn't print comes back nil, not a made-up 0.
- Hermetic test: majordomo's fake provider returns canned packet JSON and
  Generate unmarshals it, image + derived schema included. No live model.

The image is normalized to JPEG at the upload boundary (imagenorm from #80),
which is where an iPhone HEIC becomes readable — majordomo's media path can't
decode HEIC. imagenorm now links into the binary (~7 MB, the cost #80 deferred).

The hard part is catalog matching, not OCR (internal/service/seed_packet.go):
- A wrong auto-match splits a variety's seed-lot history across duplicate rows,
  so the service NEVER auto-creates. matchPlants surfaces RANKED candidates
  (exact name → variety-in-name → same species, conservative and name-based),
  the user confirms, and CreateFromPacket makes the plant (new or existing) + the
  lot. Exactly one of plantId/newPlant, refused otherwise.
- Plants/lots aren't in the undo history (catalog/inventory), so no change set.
- The extractor is injectable (service.WithPacketExtractor) so ExtractSeedPacket
  and the /scan endpoint test end to end against a fake, no live model.

Endpoints: POST /seed-lots/scan (multipart image → proposal, reads only; extends
the read deadline for a slow phone upload, caps the body, maps too-large/unreadable
to clear statuses) and POST /seed-lots/from-packet (confirmed proposal → 201).

Docs: README (PANSY_VISION_MODEL), DESIGN (routes + the decision and why the
model can't touch the garden).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

internal/service/service.go

@@ -9,6 +9,7 @@
 package service
 
 import (
+	"context"
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
@@ -18,6 +19,7 @@ import (
 
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/store"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/vision"
 )
 
 // timeLayout is the ISO-8601 UTC format used for every full timestamp pansy
@@ -41,16 +43,35 @@ type Service struct {
 	// produced by timingHash (fixed salt, no RNG) so it is always present — an
 	// empty one would silently re-open account enumeration.
 	dummyHash string
+	// extractPacket reads a photographed seed packet (#81). Injectable so tests
+	// can supply a canned packet instead of calling a live vision model — the
+	// same reason `now` is injectable. Defaults to vision.Extract.
+	extractPacket func(ctx context.Context, apiKey, modelSpec string, jpeg []byte) (vision.SeedPacket, error)
+}
+
+// Option customizes a Service at construction. The only current use is injecting
+// a seed-packet extractor in tests so they don't call a live vision model.
+type Option func(*Service)
+
+// WithPacketExtractor overrides how a photographed seed packet is read (#81).
+// Production uses vision.Extract; a test supplies a canned reader.
+func WithPacketExtractor(fn func(ctx context.Context, apiKey, modelSpec string, jpeg []byte) (vision.SeedPacket, error)) Option {
+	return func(s *Service) { s.extractPacket = fn }
 }
 
 // New constructs a Service.
-func New(st *store.DB, cfg *config.Config) *Service {
-	return &Service{
-		store:     st,
-		cfg:       cfg,
-		now:       time.Now,
-		dummyHash: timingHash(),
+func New(st *store.DB, cfg *config.Config, opts ...Option) *Service {
+	s := &Service{
+		store:         st,
+		cfg:           cfg,
+		now:           time.Now,
+		dummyHash:     timingHash(),
+		extractPacket: vision.Extract,
 	}
+	for _, o := range opts {
+		o(s)
+	}
+	return s
 }
 
 // formatTime renders a time as pansy's canonical UTC string.