feat: generate 150px thumbnail on upload (spec 001, closes #1)

[spakai]

Title: feat: generate 150px thumbnail on upload (spec 001)

Body:

Summary

Adds a thumbnail generation step to the image-processing pipeline. Every upload to uploads/ now produces a 150px (longest-side) thumbnail under thumbnails/ with aspect ratio preserved, and the DynamoDB metadata record gains a thumbnail_key attribute.

Linked spec / issue

• Spec: specs/001-thumbnail/spec.md
• Closes [Feature] Generate a thumbnail on upload #1

Acceptance criteria

• For every uploads/ object a corresponding object is created under thumbnails/ with the same base filename — satisfied by: test_resize_detect_and_persist asserts call_args_list[1].kwargs["Key"] == "thumbnails/photo.jpg" and the integration test polls head_object for thumbnail_key
• Thumbnail longest side ≤ 150px, aspect ratio preserved (no stretching) — satisfied by: test_resize_detect_and_persist asserts thumb.size == (150, 113) for a 2000×1500 input; a 150×150 square would fail this assertion
• DynamoDB metadata record gains thumbnail_key attribute — satisfied by: test_resize_detect_and_persist and test_pipeline_survives_missing_rekognition both assert item["thumbnail_key"] == {"S": "thumbnails/photo.jpg"}
• Existing behaviour unchanged: resized/ object and all current metadata fields still produced — satisfied by: call_args_list[0] asserts resized/photo.jpg with max side ≤ 1024; all pre-existing DynamoDB fields asserted present; test_pipeline_survives_missing_rekognition still passes unchanged
• Unit tests assert thumbnail size and new metadata field — satisfied by: size assertion (thumb.size == (150, 113)) and thumbnail_key DynamoDB assertion in test_resize_detect_and_persist
• Integration test confirms thumbnails/ object appears after upload to LocalStack — satisfied by: test_upload_triggers_pipeline polls head_object for thumbnail_key and asserts thumbnail_found
• ruff check . clean and CI green — satisfied by: ruff passes locally; CI runs unit + integration-localstack jobs on this PR

Verification

• ruff check . clean
• pytest tests/test_handler.py passes locally
• CI green (unit + integration-localstack)

Guardrails

• No secrets committed
• uploads/ S3 event filter unchanged
• handler.py remains environment-agnostic