fix(products): bomb-safe image processing + per-image error isolation; honest claim/resumability docs (SLICE-7 review)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/domains/products/imagefetch.py

@@ -89,23 +89,28 @@ def _process_one(pool, store, image: dict, allow_private: bool) -> None:
         with pool.connection() as conn:
             repo.mark_image_failed(conn, image_id, str(exc)[:200]); conn.commit()
         return
-    result = images_mod.process(data)
-    if isinstance(result, images_mod.Rejected):
-        reason = ("below the resolution bar" if result.reason == "rejected_low_res"
-                  else "not a supported image")
+    try:
+        result = images_mod.process(data)
+        if isinstance(result, images_mod.Rejected):
+            reason = ("below the resolution bar" if result.reason == "rejected_low_res"
+                      else "not a supported image")
+            with pool.connection() as conn:
+                repo.mark_image_rejected(conn, image_id, result.reason, reason); conn.commit()
+            return
+        keys = {"original": _key(sf, image_id, "original"),
+                "thumb": _key(sf, image_id, "thumb.webp"),
+                "card": _key(sf, image_id, "card.webp"),
+                "detail": _key(sf, image_id, "detail.webp")}
+        store.put(keys["original"], data, ctype)
+        store.put(keys["thumb"], result.renditions["thumb"], "image/webp")
+        store.put(keys["card"], result.renditions["card"], "image/webp")
+        store.put(keys["detail"], result.renditions["detail"], "image/webp")
         with pool.connection() as conn:
-            repo.mark_image_rejected(conn, image_id, result.reason, reason); conn.commit()
-        return
-    keys = {"original": _key(sf, image_id, "original"),
-            "thumb": _key(sf, image_id, "thumb.webp"),
-            "card": _key(sf, image_id, "card.webp"),
-            "detail": _key(sf, image_id, "detail.webp")}
-    store.put(keys["original"], data, ctype)
-    store.put(keys["thumb"], result.renditions["thumb"], "image/webp")
-    store.put(keys["card"], result.renditions["card"], "image/webp")
-    store.put(keys["detail"], result.renditions["detail"], "image/webp")
-    with pool.connection() as conn:
-        repo.mark_image_fetched(conn, image_id, keys); conn.commit()
+            repo.mark_image_fetched(conn, image_id, keys); conn.commit()
+    except Exception as exc:  # noqa: BLE001 — one bad image must never wedge the run (review fix)
+        with pool.connection() as conn:
+            repo.mark_image_failed(conn, image_id, f"processing error: {type(exc).__name__}")
+            conn.commit()
 
 
 def run_image_phase(pool, store, run_id: int, allow_private: bool) -> None:

backend/app/platform/images.py

@@ -60,7 +60,7 @@ def process(data: bytes) -> Processed | Rejected:
                 height=height,
                 renditions=renditions,
             )
-    except (UnidentifiedImageError, OSError, ValueError):
+    except (UnidentifiedImageError, OSError, ValueError, Image.DecompressionBombError):
         return Rejected(reason="rejected_not_image")