Keep each face's quality, and never compare against a poor one

The embedder's raw output has a length, and the length is a reading of
how recognisable the crop was: a blur, an occlusion or a hard profile
comes out short. Normalising threw it away. A short vector sits near
the middle of the sphere and matches a little of everyone, which is how
one bad crop bridges two people in a grouping pass.

So the length is kept — the store now holds the raw vector, re-normalised
on load, with the length beside it as `faces.quality` — and a face under
MIN_GALLERY_QUALITY (14) is a probe: measured against the gallery and
placed where it fits, but never what another face is measured against.
Two probes are never paired, and a probe is nobody's evidence for a
confidence. The People screen shows the number as "Quality 17.3", dimmed
below the floor.

Faces indexed before this stored unit vectors and have no reading; they
are admitted to the gallery, and schema V14 forgets the run marker of
every image holding one so the next indexing pass measures them. A
peer's unmeasured shard faces are not adopted, or a sync would write
that marker back.

ui/dr-ui/examples/face_index.rs

@@ -286,15 +286,16 @@ fn tune_thresholds(catalog: &Catalog) {
 
     let model = dr_face::ModelId::new(MODEL_ID.to_string());
     let mut candidates = Vec::with_capacity(stored.len());
-    for (face_id, image_id, blob, crop_px) in stored {
-        let Some(emb) = dr_face::Embedding::from_f16_bytes(model.clone(), &blob) else {
+    for f in stored {
+        let Some(emb) = dr_face::Embedding::from_f16_bytes(model.clone(), &f.embedding) else {
             continue;
         };
         candidates.push(dr_face::Candidate {
-            face: face_id.0,
-            image: image_id.0,
+            face: f.face.0,
+            image: f.image.0,
             embedding: emb.v.to_vec(),
-            crop_px,
+            crop_px: f.crop_px,
+            quality: f.quality,
             confirmed_person: None,
         });
     }