Start face indexing from Settings

Beside the thumbnail sweep, because it is the same kind of thing: a job
that runs for an hour, is asked for once, and reports into the activity
list above it. It is also downstream of that sweep -- detection reads the
proxies it builds -- so the two belong in that order, and the coverage
line says how many images are waiting on a proxy rather than only how
many are left to index.

The button drives the Identity Manager's own state rather than a second
copy, so it cannot disagree with that screen about whether a pass is
running, and either place can start or stop it.

The pass now opens an activity row. The caption promises progress will
appear in the list above, and without a row it would not: the button
would be the only sign anything was happening, invisible from every
other screen.

Coverage is read when the Settings page opens. The figures live in the
catalog and this page deliberately holds no session, so they arrive
through a closure rather than being kept current -- they are only ever
looked at while the page is on screen, and the check is two counts and an
indexed scan.

Also adds DARKROOM_NO_SYNC. Redirecting XDG_DATA_HOME isolates a test
launch's catalog and thumbnails but not its server, and I found that out
by pushing a test catalog over the live one. The guard sits in
start_derived_sync rather than at its three call sites, because the sweep
firing a sync is correct and a flag checked in three places is one that
gets missed in a fourth.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ui/dr-ui/src/library_ui.rs

@@ -3317,6 +3317,22 @@ fn apply_zoom(window: &AppWindow, ctl: &Rc<LibraryController>, delta: i32) {
 /// Fired after the sweep completes, when there is a finished index worth
 /// sharing, and from the Sync button for an explicit exchange.
 fn start_derived_sync(window: &AppWindow, ctl: &Rc<LibraryController>) {
+    // An escape hatch for running the app against a *copied* library without
+    // touching the account's real server.
+    //
+    // Added after doing exactly that by accident: a local test launch
+    // completed its thumbnail sweep, which fires this, which pushed a test
+    // catalog over the live one. Redirecting `XDG_DATA_HOME` isolates the
+    // catalog and the thumbnails but not the server, and nothing said so.
+    //
+    // The guard belongs here rather than at the call sites: the sweep firing a
+    // sync is correct — the point of building thumbnails is sharing them — and
+    // a flag checked in three places would eventually be missed in a fourth.
+    if std::env::var_os("DARKROOM_NO_SYNC").is_some() {
+        log::info!("derived sync suppressed by DARKROOM_NO_SYNC");
+        return;
+    }
+
     let Some((creds, session, _)) = ctl.session.borrow().clone() else {
         return;
     };