Minor backend/wasm hardening (deferred non-blockers from v3 review)

Small, individually-low-risk items surfaced during the v3 review and accepted as non-blocking. Grouped to avoid issue spam; split out if any one grows teeth.

• Default-tag first-use race — findOrCreateDefaultTag: concurrent first uploads into a fresh project can race to create the same default tag. Self-heals (unique constraint / next read), but worth a GetOrCreate upsert or advisory lock.
• Statistics N+1 — the statistics endpoint issues per-entity queries in a loop; fine at current scale, candidate for a single aggregate query if it shows up in latency.
• Image-create not transactional — record insert + derived work aren't wrapped in one tx; a mid-flight failure can leave partial state. Currently self-correcting on retry; wrap if it ever causes visible inconsistency.
• WASM error-path memory — ui/src/util/fileProcessor.ts retains the original ArrayBuffer on some error paths (known FIXME); release on failure to cap peak memory during large batch uploads.

Filed as a deferred finding from the v3 rewrite review (#44/#45/#46/#47). Non-blocking; tracked for a follow-up.

Choose one deferred item before starting, since this issue groups four separate concerns. Inspect findOrCreateDefaultTag, the statistics endpoint, the image-create flow, or ui/src/util/fileProcessor.ts, depending on the selected scope. Done means addressing the chosen race, query pattern, partial-state risk, or error-path buffer retention without expanding into the other non-blocking findings.