Feat/ai jetstream listener

[Tyjfre-j]

Summary

This PR implements a single‑face image matching worker driven by JetStream/NATS. The worker listens for face‑match requests, fetches images from MinIO, generates embeddings for single‑face images only, matches against users via pgvector similarity, and records the match. The flow is event‑driven, idempotent, and includes explicit guardrails + logging for failure modes.

Full Workflow

1. Event Trigger
   A job is published to photo_faces.single.requested (JetStream).
   Payload includes photo_id, image_ref, optional face_index, optional faces_detected, and extra metadata (ignored).

2. Subscription & Validation
   SingleFaceMatchWorker subscribes using a durable consumer.
   Payload is validated via SingleFaceMatchJob; malformed payloads are logged and skipped.

3. Guardrails

If faces_detected is provided and != 1 → skip
If image_ref missing → skip
If photo_id not found → skip
If match already exists for photo → skip (idempotency)
4) Image Fetch (MinIO)
image_ref is parsed and fetched from MinIO.
Transient failures are retried with linear backoff.

5. Face Detection / Embedding
   Image is decoded; all faces are detected.
   If not exactly one face → skip.
   Embedding + bounding box extracted.

6. Upsert photo_faces
   Writes photo_id, face_index, embedding, bbox.
   DB errors are logged + rolled back.

7. User Matching
   Finds closest user via pgvector similarity:
   ORDER BY face_embedding <=> :embedding LIMIT 1
   If no user embeddings → skip.

8. Insert face_matches
   If match doesn’t exist, insert new row with confidence = distance.

[wailbentafat]

file structure is wrong u will fix it in the next pr

[Tyjfre-j]

Bon.