Add remove-from-rotation, fix mobile scroll-vs-drag conflict

Remove from rotation: a new bounded exclude list
(FrameConfig.excluded_asset_ids) that photo_queue._top_up() never
selects from. POST /api/queue/remove scrubs an asset out of
queue/history too so it can't resurface via "Show next" or the back
button, and if it was the current photo, advances away from it
immediately -- without recording it in history, since going back to a
photo you just explicitly removed doesn't make sense. Doesn't touch
Immich or the album itself, just this frame's own selection. Wired into
the web UI as a small "x" button on both the current-photo thumbnail
and every upcoming card.

Mobile scroll fix: touching a card to scroll the page was being
captured as a drag attempt every time (touch-action: none on every
.photo-card, needed for the existing drag-reorder gesture to work at
all), making it too easy to accidentally reorder instead of scroll.
Reworked touch dragging to require a brief hold (350ms, roughly
stationary) before it arms -- touch-action stays "pan-y" (native
scroll allowed) the whole time up to that point, so a normal
touch-and-swipe scrolls the page like anywhere else, and only switches
to "none" once a hold is confirmed as deliberate. Mouse dragging is
unchanged (no hold delay -- no scroll-vs-drag ambiguity with a mouse).
Also made the "Show next" and new remove buttons always visible instead
of hover/focus-revealed, since that was invisible-but-still-tappable on
touch (no hover state) -- a real hazard for a destructive action.

server/app/main.py

@@ -132,6 +132,7 @@ def api_config_save(
             cfg.queue = []
             cfg.queue_cursor = 0
             cfg.history = []
+            cfg.excluded_asset_ids = []
         cfg.album_id = album_id
         cfg.order = order if order in ("sequential", "shuffle") else "sequential"
         cfg.refresh_interval_s = max(MIN_REFRESH_INTERVAL_S, min(MAX_REFRESH_INTERVAL_S, refresh_interval_s))
@@ -488,6 +489,28 @@ def api_queue_promote(body: QueuePromoteRequest):
     return {"status": "saved"}
 
 
+class QueueRemoveRequest(BaseModel):
+    asset_id: str
+
+
+@app.post("/api/queue/remove", dependencies=[Depends(require_access_token)])
+def api_queue_remove(body: QueueRemoveRequest):
+    """Permanently removes a photo from this frame's rotation -- "Remove"
+    in the web UI, on either an upcoming card or the current photo. Does
+    NOT touch Immich or the album itself; see photo_queue.remove_from_rotation()."""
+    cfg = config.load()
+    _require_configured(cfg)
+
+    client = ImmichClient(cfg.immich_url, cfg.immich_api_key)
+    assets = _list_assets(client, cfg)
+
+    with config.locked():
+        cfg = config.load()  # re-read: state may have changed since the unlocked read above
+        photo_queue.remove_from_rotation(cfg, assets, body.asset_id)
+        config.save(cfg)
+    return {"status": "removed"}
+
+
 @app.get("/api/photo-thumbnail/{asset_id}", dependencies=[Depends(require_access_token)])
 def api_photo_thumbnail(asset_id: str):
     cfg = config.load()