Merge master into tablet-selection

Two real conflicts, both from work that landed either side of the same
lines rather than against them.

`lib.rs`: the settings controller was hoisted above the People screen's
wiring, and Android's thumbnail-tier eviction registered itself at the
same point. Independent, so both stay.

`library.rs`: manual collection ordering and burst folding each added a
clause to the same two queries. The scoped range read now carries both —
the folding matters there for one step further on than it does in the
grid, because a collapsed burst is one cell, so an ordinal counted over a
list still holding every frame names a photograph several places away
from the one the user pointed at.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ui/dr-ui/src/identity_ui.rs

@@ -111,6 +111,21 @@ impl IdentityController {
     fn clear_picks(&self) {
         self.picked.borrow_mut().clear();
     }
+
+    /// TRACES: FR-PLAT-AND-5 | NFR-RES-1
+    /// Drop the decoded rail portraits.
+    ///
+    /// The one in-memory image cache in this crate that is unbounded by
+    /// anything but the library: one decoded portrait per person, kept for as
+    /// long as the person exists. On a library with a few hundred named people
+    /// that is worth tens of megabytes of nothing but a saved decode.
+    ///
+    /// Costless to lose. `refresh` rebuilds any portrait it does not find, so
+    /// the only consequence is the JPEG decode this cache exists to skip, and
+    /// only for the people the rail is actually showing at the time.
+    pub fn clear_covers(&self) {
+        self.covers.borrow_mut().clear();
+    }
 }
 
 /// Push the people rail and the face grid into the window.