feat(web): stream narrative via SSE, wire Instagram carousel button, polish privacy

[ditvor]

Summary

Phase 5 polish on top of the FastAPI web builder. Three features in one PR
because they share the rendered-memory route surface and would otherwise
need each other's plumbing back-ported.

• SSE streaming. POST /generate now does just the deterministic prep
  phase (parse GPX, load photos, persist pending.json) and returns a
  generating page that opens an EventSource to the new
  GET /generate/{slug}/stream. The SSE endpoint runs the LLM via
  AnthropicClient.complete_stream and emits chunk / status / done /
  error events. One parse-failure retry flips the page to a
  "regenerating" state; double failure lands an error. Pending state is
  unlinked on success so the SSE endpoint cannot be re-triggered (and
  cannot pay the bill twice).
• Instagram carousel button on every style template. Posts to
  /memory/{slug}/carousel, fetches each slide as a Blob, and either
  calls navigator.share({files}) (iOS Safari path → "Save N Images" share
  sheet → two-tap to Instagram) or renders desktop fallback download links.
  The slide route now sets Content-Disposition: attachment with a
  slug-namespaced filename so desktop saves land cleanly in ~/Downloads.
• Privacy polish. The privacy page is now an explicit six-step
  lifecycle that links to specific line ranges in web/storage.py
  (cleanup_inputs, sweep_expired) and web/app.py (_run_sweeper) on
  GitHub. The form's privacy link reads "How we handle your photos →" and
  opens in a new tab.

The unused synchronous web.pipeline.run_pipeline was removed — the
streaming flow has fully replaced it.

Test plan

• make ci — 286 tests pass, ruff clean, mypy clean, 95% total
  coverage.
• New tests/test_web.py cases: generating-page rendering, full
  SSE handshake (chunk → status → done), retry path, double-
  failure error path, 404-after-consume, content-type header,
  end-to-end retention sweep.
• New tests/test_instagram_button.py: button renders in all three
  styles (parametrized), navigator.canShare + fallback both wired,
  carousel returns N+2 slides, slide downloads carry attachment
  Content-Disposition with slug, idempotent POSTs.
• New streaming tests in tests/test_client.py and
  tests/test_narrative.py: rate-limit retry before first chunk,
  mid-stream error surfaces without retry, status-error translation,
  JSON-parse retry, schema-validation failure surfaced cleanly.
• End-to-end smoke test against the running app via TestClient:
  landing → POST → SSE drain → memory page → carousel POST → slide
  download. Passes.
• Manual mobile QA pending. Test on a real phone (or DevTools
  mobile emulation at 375px) the full upload → streaming page →
  memory → "Save for Instagram" → share sheet flow.

🤖 Generated with Claude Code