Narrow the grid to several people at once, either way

"Show photos" could only ever mean one person. The two questions a photographer
actually asks are "every picture of Anna or Bob" and "the pictures they are both
in", and the second is not reachable by any sequence of single-person filters —
no amount of switching between one person and another finds the frame they
share.

So the filter holds a *set* of people and a mode. `RatingFilter` was already the
right home, as its own doc says: every query path threads it, so the count in
the header and the cells in the grid are narrowed by the same thing, and this
composes with stars, flags and the date range for free.

The union is `EXISTS ... person_id IN (...)`. The intersection counts
**distinct** people per image and compares against the size of the selection —
one subquery rather than one per person, and it does not grow the statement with
the selection. `DISTINCT` is what makes it correct: three faces of Anna in one
frame must not satisfy a filter asking for Anna and Bob, and there is a test
that says so.

Any rather than All is the default. With one person the modes are the same
filter, and adding a second to a union can only ever show more — so a user who
has not noticed the toggle never ends up staring at an empty grid wondering what
they broke. The toggle only appears at two people, because a control that
demonstrably does nothing is a control that teaches the user to ignore it.

Building the set needs no picker of its own: the Identity screen gains "And
also…" beside "Show photos", offered only once the grid is already narrowed to
somebody. Each person is a chip on the filter bar and each chip removes just
that person, so a selection of three can be taken apart one at a time rather
than only cleared wholesale.

`RatingFilter` stops being `Copy`, since it now holds a `Vec`. Every query path
already took it by reference; the casualties were two struct updates and one
`Cell` that becomes a `RefCell`.

484 dr-ui tests pass, including the union, the intersection, that one person
reads the same in both modes, and the repeated-faces trap.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ui/dr-ui/ui/identity.slint

@@ -241,7 +241,14 @@ export component IdentityScreen inherits Rectangle {
     /// Set a person aside, or bring them back.
     callback ignore-person(int, bool);
     /// Show every photograph this person appears in, in the library grid.
-    callback show-photos(int);
+    ///
+    /// The flag is whether to *add* to whoever the grid is already narrowed
+    /// to, rather than replace them — which is how a union or an intersection
+    /// of several people gets built without a person-picker of its own.
+    callback show-photos(int, bool);
+    /// Whether the library grid is already narrowed to somebody, so the
+    /// "and also" button only appears when there is something to add to.
+    in property <bool> photos-filtered: false;
     callback recluster();
     callback index-faces();
     callback stop-indexing();
@@ -479,7 +486,14 @@ export component IdentityScreen inherits Rectangle {
                 // screen is a filing cabinet with no drawer handles.
                 if root.selected-person >= 0: Button {
                     text: "Show photos";
-                    clicked => { root.show-photos(root.selected-person); }
+                    clicked => { root.show-photos(root.selected-person, false); }
+                }
+                // Builds the union or intersection a person at a time. Only
+                // offered once the grid is narrowed to somebody, because
+                // "and also" with nothing to add to is just "Show photos".
+                if root.selected-person >= 0 && root.photos-filtered: Button {
+                    text: "And also…";
+                    clicked => { root.show-photos(root.selected-person, true); }
                 }
                 // Most clusters in a real library are strangers — passers-by,
                 // other people's guests, a face on a poster. Naming them is