Files: optional image analysis on upload, suggested tags and a content safety flag, Google Cloud Vision first

An opt-in check on image uploads: suggested tags, and a flag when an image is likely explicit, so an editor sees both before the image goes on a public page.

## What a provider actually returns

Label detection returns keywords with scores ("dog", "beach", "sunset"), not a sentence. That is useful as suggested tags and as a hint while writing alt text, but it is not alt text, and alt text stays written by a person (#668 keeps it on the file). SafeSearch returns a likelihood for adult, violence and racy content per image.

Google Cloud Vision is the first candidate: the first 1,000 units per month are free for every feature, and SafeSearch is free when requested together with label detection (https://cloud.google.com/vision/pricing). After that it is metered, which is why this is off unless configured.

## Proposal

- **A provider interface in the Files module** (`IImageAnalysis`: labels with scores, a SafeSearch-style likelihood set), with no provider registered by default. Nothing changes for existing installs.
- **A module, `BarakoCMS.AI.Vision` or a provider inside `BarakoCMS.AI`**, that implements it against Google Cloud Vision when credentials are set. Credentials follow the storage settings pattern in #781: encrypted, write-only, testable.
- **When it runs:** after an image upload is accepted and stored, in the background job queue, so an upload never waits on or fails because of a third party. PNG, JPEG, WebP and GIF only, using the image variants ladder so the provider receives a 640 px copy, not a 10 MB original.
- **What is stored:** `SuggestedTags` and `ContentSafety` (likelihoods plus the provider and time) on `StoredFile`. Nothing is applied to content automatically.
- **What it never does:** refuse or delete an upload on its own. A flagged file shows a badge; an Admin decides. An option to hold flagged public files as private until reviewed can come later.
- **Privacy:** the image leaves the server. The module's README says so, names the provider, and the setting is per tenant.

## Done when

- With no provider configured, uploads and file metadata are unchanged (test).
- With a fake provider, an accepted image gets tags and a safety result from the background job, a provider failure is logged and retried without touching the file, and a non-image is skipped (tests).
- A manual check against Google Cloud Vision with a real key confirms the request shape and the free-tier units consumed per image.

Related: #668 (image field, alt text), #781 (settings pattern), BaryoDev/barakoBrew#122 (image field editor, where tags and the safety badge would show).

Start in the Files module and trace image upload acceptance, the image variants ladder, the background job queue, and StoredFile metadata. Read the proposed IImageAnalysis contract and the storage settings pattern from #781, then review the Google Cloud Vision request shape. Done means the listed fake-provider, retry, non-image, and no-provider tests pass, with a manual real-key check confirming the request and units.

Written by the indexing model from the issue text.