feat(drive): impl policy photo + music policies

add `include_in_photo_index` and `include_in_music_index` policies
    both true for default personal drive

    photo is implemented
    music is not yet implemented

src/common/di.rs

@@ -912,12 +912,20 @@ impl AppServiceFactory {
     }
 
     /// Creates the Places (photo map) service. Reuses the existing file-read
-    /// repository — the data is the caller's own geotagged photos.
+    /// repository — the data is the caller's Photos-scope geotagged photos
+    /// (§15: default personal drive + drives with
+    /// `include_in_photo_index = true` AND caller has Read).
+    /// `authorization` is used for the same subject expansion that
+    /// `photos_handler::list_photos` runs.
     pub fn create_places_service(
         &self,
         file_read: &Arc<FileBlobReadRepository>,
+        authorization: &Arc<crate::infrastructure::services::pg_acl_engine::PgAclEngine>,
     ) -> Arc<PlacesService> {
-        let service = Arc::new(PlacesService::new(file_read.clone()));
+        let service = Arc::new(PlacesService::new(
+            file_read.clone(),
+            authorization.clone(),
+        ));
         tracing::info!("Places service initialized");
         service
     }
@@ -1285,7 +1293,7 @@ impl AppServiceFactory {
             apps.recent_service = Some(recent_service_eager.clone());
 
             places_service = if core.config.features.enable_places {
-                Some(self.create_places_service(&repos.file_read_repository))
+                Some(self.create_places_service(&repos.file_read_repository, &authorization))
             } else {
                 None
             };