Add a tags field to the Android and desktop uploaders

Each photo card gains a free-text tags input, sent as a raw
comma-separated `tags` form field on upload. The server normalizes it
(parseTags), so the clients stay dumb — no tag parsing on-device.

- Android: PickedItem.tags + setTags; threaded through UploadQueue →
  UploadWorker → UploadClient's multipart.
- Desktop: a tags QLineEdit per PhotoItemWidget; UploadClient.upload sends
  it.

desktop/mainwindow.cpp

@@ -313,7 +313,7 @@ void MainWindow::startItem(PhotoItemWidget *item)
                             refreshPosting();
                         });
                 client->upload(prepared.filePath, QFileInfo(prepared.filePath).fileName(),
-                               caption, item->date());
+                               caption, item->date(), item->tags());
             });
     watcher->setFuture(QtConcurrent::run([source, cacheDir, slug]() {
         return ImagePrep::prepare(source, cacheDir, slug);

desktop/photoitemwidget.cpp

@@ -47,6 +47,10 @@ PhotoItemWidget::PhotoItemWidget(QString sourcePath, QWidget *parent)
     m_date->setDisplayFormat(QStringLiteral("yyyy-MM-dd"));
     fields->addWidget(m_date);
 
+    m_tags = new QLineEdit;
+    m_tags->setPlaceholderText(QStringLiteral("tags (comma-separated)"));
+    fields->addWidget(m_tags);
+
     m_statusLabel = new QLabel;
     m_statusLabel->setOpenExternalLinks(true);
     m_statusLabel->setWordWrap(true);
@@ -70,6 +74,11 @@ QString PhotoItemWidget::date() const
     return m_date->date().toString(QStringLiteral("yyyy-MM-dd"));
 }
 
+QString PhotoItemWidget::tags() const
+{
+    return m_tags->text();
+}
+
 void PhotoItemWidget::setStatus(Status status, const QString &message, const QString &url)
 {
     m_status = status;
@@ -79,6 +88,7 @@ void PhotoItemWidget::setStatus(Status status, const QString &message, const QSt
     const bool editable = status == Status::Pending || status == Status::Error;
     m_caption->setEnabled(editable);
     m_date->setEnabled(editable);
+    m_tags->setEnabled(editable);
     m_remove->setEnabled(status != Status::Preparing && status != Status::Uploading);
 
     switch (status) {

desktop/photoitemwidget.h

@@ -21,6 +21,7 @@ public:
     QString sourcePath() const { return m_sourcePath; }
     QString caption() const;
     QString date() const; // yyyy-MM-dd
+    QString tags() const; // raw comma-separated; the server normalizes
     Status status() const { return m_status; }
 
     void setStatus(Status status, const QString &message = {}, const QString &url = {});
@@ -35,6 +36,7 @@ private:
     QLabel *m_thumb = nullptr;
     QLineEdit *m_caption = nullptr;
     QDateEdit *m_date = nullptr;
+    QLineEdit *m_tags = nullptr;
     QLabel *m_statusLabel = nullptr;
     QPushButton *m_remove = nullptr;
 };

desktop/uploadclient.cpp

@@ -26,7 +26,7 @@ QByteArray UploadClient::authHeader() const
 }
 
 void UploadClient::upload(const QString &filePath, const QString &fileName,
-                          const QString &caption, const QString &date)
+                          const QString &caption, const QString &date, const QString &tags)
 {
     auto *file = new QFile(filePath);
     if (!file->open(QIODevice::ReadOnly)) {
@@ -57,6 +57,7 @@ void UploadClient::upload(const QString &filePath, const QString &fileName,
     };
     multiPart->append(textPart(QStringLiteral("caption"), caption));
     multiPart->append(textPart(QStringLiteral("date"), date));
+    multiPart->append(textPart(QStringLiteral("tags"), tags));
 
     QNetworkRequest request(QUrl(m_base + QStringLiteral("/upload")));
     request.setRawHeader("Authorization", authHeader());

desktop/uploadclient.h

@@ -29,7 +29,7 @@ public:
     // The filename matters: server.go derives the slug from it, so re-sending
     // the same name overwrites the same post instead of duplicating it.
     void upload(const QString &filePath, const QString &fileName,
-                const QString &caption, const QString &date);
+                const QString &caption, const QString &date, const QString &tags);
 
     // Credential check via GET /upload (same Basic-auth gate the POST uses).
     // /health is not usable: nginx only proxies location /upload.