Add, remove and reorder a launched listing's photos; the first one is the hero on the flyer and the email #27

Intent: the photographer's shots arrive after the listing is launched, and the agent needs to swap the hero photo before the flyer goes out, without launching the listing again.

Done looks like:

• [ ] On Edit facts (from the facts issue this waits on), whoever may edit the listing can add photos up to the same limits (eight in all, 24 MB, acceptPhoto in src/photos.ts), remove one, and make any photo the first, which is the hero.
• [ ] New files are written only with their row, and removed files are unwritten only after the row commits, the same rule launch follows (writePhoto/unwritePhotos). A failed upload leaves the listing's photos exactly as they were.
• [ ] The change is audited as listing.update and emits listing.changed. It clears the flyer's and the email's approval, because what they show changed. The other assets keep theirs.
• [ ] Reachable as a form POST (same-origin checked) and through the JSON API (a photo order and removals; uploads are multipart on the page only, and the README says so).
• [ ] Tests: add one photo, then make it the hero, and the flyer's and email preview's <img> point at it. Remove one, and its file is gone from FORGE_APP_DATA. A ninth photo is refused and nothing changes. Another user is refused.
• [ ] README: one line under 'Type the property in' saying photos can be changed later.
• [ ] bun test, bun x tsc --noEmit and bun scripts/design-lint.ts pass.

Files: src/actions.ts, src/photos.ts, src/routes.ts, src/pages/listing.ts, src/listings.test.ts, README.md. Risks: deleting files outside the transaction must never delete a file another row still names. Check the photo name belongs to this listing before removing it (no path from user text). Suggested crew: a builder.