cleanup: remove dead code and duplicate docs

- Remove session-ses_2f27.md (161KB raw session log)
- Remove 49 ROOT_* duplicate files across REFERENCE/
- Remove 14 duplicate files between REFERENCE/ root and history/
- Remove asr_legacy.rs (dead code, replaced by asr.rs)
- Remove src/core/worker/ (duplicate JobWorker)
- Remove src/core/layers/ (empty directory)
- Remove 4 .bak files in src/
- Remove 7 dead private methods in worker/processor.rs
- Remove backup directory from git tracking

src/api/identities.rs

@@ -56,7 +56,10 @@ pub fn identity_routes() -> Router<crate::api::server::AppState> {
             "/api/v1/identities/:identity_id/faces",
             get(get_identity_faces),
         )
-        .route("/api/v1/faces/:face_id/thumbnail", get(get_face_thumbnail))
+        .route(
+            "/api/v1/files/:file_uuid/faces/:face_id/thumbnail",
+            get(get_face_thumbnail),
+        )
 }
 
 /// Register a Global Identity from face.json with multi-angle reference vectors.
@@ -719,7 +722,7 @@ async fn get_identity_faces(
 }
 
 async fn get_face_thumbnail(
-    Path(face_id): Path<i32>,
+    Path((file_uuid, face_id)): Path<(String, i32)>,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
     let db = match PostgresDb::init().await {
         Ok(db) => db,
@@ -738,12 +741,13 @@ async fn get_face_thumbnail(
         "SELECT fd.frame_number, fd.bbox, v.file_path, v.fps
          FROM {} fd
          JOIN {} v ON fd.file_uuid = v.uuid
-         WHERE fd.id = $1",
+         WHERE fd.id = $1 AND fd.file_uuid = $2",
         table_fd, table_v
     );
 
     let row: Option<(i64, Option<serde_json::Value>, String, f64)> = match sqlx::query_as(&sql)
         .bind(face_id)
+        .bind(&file_uuid)
         .fetch_optional(db.pool())
         .await
     {