Make photo backfill single-flight and fail on unrecorded writes

Task 36c40130-a69a-46ed-a047-2cdc5ee2d2e0, remediation of review
findings F23-1 and F23-2 (PR #205).

F23-1: StartPhotoBackfill now checks, in the same write transaction
that enqueues, for a full backfill_dinner_photos job already queued or
running (new GetActivePhotoBackfillJob query) and returns its id instead
of enqueuing another, as plan.StartDraft does with GetActiveDraftJob.
The claim is the stored job row, so it holds across restarts; a job left
running by a stopped process is failed at boot and no longer blocks.

F23-2: a dinner whose outcome write fails is still reported failed with
grounding_error and the remaining dinners still run, but the job then
fails (internal_error, as a ground_dinner job's failed write does) with
the per-dinner outcomes published as its result, so it never reports
success for state it did not store.

Tests: overlapping triggers while queued, after a restart and while
running return the one job; a refused dinner write fails the job.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/db/querier.go

@@ -117,6 +117,10 @@ type Querier interface {
 	// when there is none, so there is at most one. Returns sql.ErrNoRows when
 	// there is none.
 	GetActiveDraftJob(ctx context.Context, arg GetActiveDraftJobParams) (GetActiveDraftJobRow, error)
+	// The id of the full photo backfill job (no dinner_id) of kind queued or
+	// running. StartPhotoBackfill enqueues one only when there is none, so
+	// there is at most one. Returns sql.ErrNoRows when there is none.
+	GetActivePhotoBackfillJob(ctx context.Context, kind string) (string, error)
 	// The batch still pending or running, oldest first. Returns sql.ErrNoRows
 	// when there is none.
 	GetActiveSuggestionBatch(ctx context.Context) (SuggestionBatch, error)