The server derives a photo's slug from the uploaded filename, so two photos with
the same name in one batch would overwrite each other. Each card now gets a slug
that is unique among the current cards (second same-named photo becomes -2, -3,
…), computed with a client mirror of the server's sanitiseSlug and sent as the
multipart filename. The slug is assigned once when a photo is added, so it stays
stable across retries.
Kept client-side on purpose: a server-side "slug exists -> suffix" would turn
the apps' idempotent re-upload retries (same filename overwrites the same post)
into duplicates.