Keep both devices' keywords when the catalogs meet

Keywords are catalog state, and the catalog syncs. Without this, two devices
keywording the same library would resolve to whichever synced last, and an
afternoon of work would vanish with no sign it had ever happened.

The vocabulary merges per row on the rule collections already use: revision
first, timestamp only to break a tie, so a device with a skewed clock cannot win
by having the wrong idea of the time. Assignments merge as a set union, which is
FR-NC-9's principle applied to metadata instead of edit nodes — disjoint work
survives on both sides.

Three things needed care and are commented where they happen:

A deletion travels *by name*, not by identity. Both devices may have minted
their own uuid for one word before they ever synced, so deleting by uuid would
tombstone a row nothing was assigned to and leave every photograph still
carrying the word. The union then refuses to readmit a word a winning tombstone
has just removed — without that filter the remote's live assignments would
resurrect it on the very same pass.

Images are resolved by the server's file id first and the content hash second.
Membership has always used the hash alone, but the hash is computed only when
import dedup or a reconnect asks for it, which for most libraries is never — so
a hash-only union would have quietly done nothing for the ordinary photograph.

A word lands on the local default version. Version uuids do not reconcile in the
catalog at all: ensure_default_versions mints a fresh one per device, so a
uuid-keyed join would have unioned nothing.

Removal still does not propagate. That is the trade collection membership
already makes, for the same reason — an unwanted keyword is removed again in a
second, and a silently lost afternoon is not recoverable at all.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/dr-catalog/src/rating.rs

@@ -75,6 +75,24 @@ impl Judgement {
 /// The UUID is per row and generated here — it is the merge identity across
 /// devices (FR-NC-8), so two images must never share one.
 pub fn ensure_default_versions(conn: &Connection) -> Result<usize, CatalogError> {
+    // One transaction for the batch. A backfill over a 24k-image library is
+    // 24k inserts, and per-statement commits would make it minutes rather
+    // than seconds.
+    let tx = conn.unchecked_transaction()?;
+    let n = ensure_default_versions_within(&tx)?;
+    tx.commit()?;
+    Ok(n)
+}
+
+/// [`ensure_default_versions`] without opening a transaction.
+///
+/// Separate because SQLite has no nested `BEGIN`: [`crate::merge`] needs the
+/// invariant restored *inside* the merge transaction — an incoming keyword
+/// lands on a default version, so an image without one would silently drop it —
+/// and calling the public form there fails at runtime with "cannot start a
+/// transaction within a transaction". The same split, for the same reason, as
+/// `collections::add_within`.
+pub fn ensure_default_versions_within(conn: &Connection) -> Result<usize, CatalogError> {
     let ids: Vec<i64> = {
         let mut stmt = conn.prepare(
             "SELECT i.id FROM images i
@@ -89,12 +107,8 @@ pub fn ensure_default_versions(conn: &Connection) -> Result<usize, CatalogError>
         return Ok(0);
     }
 
-    // One transaction for the batch. A backfill over a 24k-image library is
-    // 24k inserts, and per-statement commits would make it minutes rather
-    // than seconds.
-    let tx = conn.unchecked_transaction()?;
     {
-        let mut insert = tx.prepare(
+        let mut insert = conn.prepare(
             "INSERT INTO versions(image_id, uuid, name, is_default, rating, flag)
              VALUES (?1, ?2, ?3, 1, 0, 0)",
         )?;
@@ -102,7 +116,6 @@ pub fn ensure_default_versions(conn: &Connection) -> Result<usize, CatalogError>
             insert.execute(rusqlite::params![id, new_uuid(), DEFAULT_VERSION_NAME])?;
         }
     }
-    tx.commit()?;
 
     Ok(ids.len())
 }