Fix build failures and get all 45 tests passing

Build fixes:
- ui/Dockerfile: npm install instead of npm ci (no lockfile)
- api/pyproject.toml: setuptools.build_meta instead of setuptools.backends.legacy:build
- api/Dockerfile: install curl so the Docker healthcheck doesn't always fail
- docker-compose.yml: add start_period: 30s to API healthcheck

Test fixes:
- pyproject.toml: asyncio_default_fixture_loop_scope/test_loop_scope = session to
  prevent asyncpg connections being used across different event loops
- conftest.py: loop_scope="session" on session-scoped engine fixture
- main.py: custom HTTPException handler to flatten dict details to top level
  (FastAPI wraps dict details as {"detail": {...}} by default)
- test_upload.py: use env var + cache_clear() to override max_upload_bytes since
  monkeypatch can't reach past @lru_cache and already-imported references
- image_repo.py: add reload_with_tags() with populate_existing=True to force
  SQLAlchemy to repopulate the identity-map object after tag mutations
- images.py: use reload_with_tags() instead of db.refresh(image, ["image_tags"])
  which only loaded ImageTag rows without their .tag sub-relationship, causing
  MissingGreenlet on any access to image.tags after attach/replace operations

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/tests/integration/test_upload.py

@@ -68,26 +68,24 @@ async def test_upload_invalid_mime_type_returns_422(client):
 
 
 @pytest.mark.asyncio
-async def test_upload_oversized_file_returns_422(client, monkeypatch):
-    import app.config as config_module
-    original_settings = config_module.get_settings()
+async def test_upload_oversized_file_returns_422(client):
+    import os
+    from app.config import get_settings
 
-    class SmallSettings:
-        def __getattr__(self, name):
-            val = getattr(original_settings, name)
-            if name == "max_upload_bytes":
-                return 10
-            return val
+    os.environ["MAX_UPLOAD_BYTES"] = "10"
+    get_settings.cache_clear()
 
-    monkeypatch.setattr(config_module, "get_settings", lambda: SmallSettings())
-
-    response = await client.post(
-        "/api/v1/images",
-        files={"file": ("big.jpg", io.BytesIO(b"x" * 11), "image/jpeg")},
-    )
-    assert response.status_code == 422
-    body = response.json()
-    assert body["code"] == "file_too_large"
+    try:
+        response = await client.post(
+            "/api/v1/images",
+            files={"file": ("big.jpg", io.BytesIO(b"x" * 11), "image/jpeg")},
+        )
+        assert response.status_code == 422
+        body = response.json()
+        assert body["code"] == "file_too_large"
+    finally:
+        del os.environ["MAX_UPLOAD_BYTES"]
+        get_settings.cache_clear()
 
 
 @pytest.mark.asyncio