feat: photo/video capture-date pipeline + premium UI/UX overhaul

Backend — Photos timeline now groups by real capture date instead of upload time. New MediaMetadataService (FileLifecycleHook) extracts EXIF DateTimeOriginal from images and container creation_time from videos (mov/mp4/mkv) via nom-exif, timezone-correct (OffsetTimeOriginal), persisting captured_at so the existing media_sort_date trigger takes over. Adds POST /admin/photos/metadata/reextract to backfill existing media. Falls back to upload date when no embedded date exists.

Frontend — premium grid cards: combined metadata line (relative date · size, owner avatar when shared), custom selection checkbox with a clear checked state, uniform full-width 4:3 thumbnail tiles independent of filename length, centered file-type icons, and a hit-test fix so checkbox/star/kebab clicks reach the controls (the decorative thumbnail no longer captures pointer events). Notification messages internationalised across all 16 locales. Broader polish: design tokens, a11y/focus-visible states, brand + PWA assets.

Chore — bump semver-compatible dependencies (cargo upgrade); add nom-exif 3.6.1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/common/di.rs

@@ -66,6 +66,7 @@ use crate::infrastructure::services::chunked_upload_service::ChunkedUploadServic
 use crate::infrastructure::services::dedup_service::DedupService;
 use crate::infrastructure::services::image_transcode_service::ImageTranscodeService;
 use crate::infrastructure::services::jwt_service::JwtTokenService;
+use crate::infrastructure::services::media_metadata_service::MediaMetadataService;
 use crate::infrastructure::services::password_hasher::Argon2PasswordHasher;
 use crate::infrastructure::services::path_resolver_service::PathResolverService;
 use crate::infrastructure::services::thumbnail_service::{ThumbnailRefreshHook, ThumbnailService};
@@ -340,6 +341,10 @@ impl AppServiceFactory {
         // Audio metadata service — created here so it can be wired into file_lifecycle.
         let audio_metadata_service = self.create_audio_metadata_service(db_pool);
 
+        // Image/video capture-metadata service — extracts EXIF/container capture
+        // dates so the Photos timeline groups by real capture time, not upload time.
+        let media_metadata_service = self.create_media_metadata_service(db_pool);
+
         // ThumbnailRefreshHook: handles FileLifecycleHook events (create/update/delete).
         // Implemented on ThumbnailRefreshHook (not ThumbnailService) to avoid circular Arc:
         //   DedupService → BlobLifecycleService → ThumbnailRefreshHook → DedupService.
@@ -353,6 +358,7 @@ impl AppServiceFactory {
         if let Some(audio) = &audio_metadata_service {
             fls = fls.with_hook(audio.clone());
         }
+        fls = fls.with_hook(media_metadata_service.clone());
         let file_lifecycle = Arc::new(fls);
 
         Ok(CoreServices {
@@ -361,6 +367,7 @@ impl AppServiceFactory {
             thumbnail_service,
             file_lifecycle,
             audio_metadata_service,
+            media_metadata_service,
             chunked_upload_service,
             image_transcode_service,
             dedup_service,
@@ -538,6 +545,7 @@ impl AppServiceFactory {
             favorites_service: None, // Configured later with create_favorites_service
             recent_service: None,    // Configured later with create_recent_service
             audio_metadata_service: core.audio_metadata_service.clone(),
+            media_metadata_service: core.media_metadata_service.clone(),
         }
     }
 
@@ -557,6 +565,16 @@ impl AppServiceFactory {
         )))
     }
 
+    /// Creates the image/video capture-metadata service (EXIF + container
+    /// creation dates). Always enabled — the Photos timeline relies on it.
+    pub fn create_media_metadata_service(
+        &self,
+        db_pool: &Arc<PgPool>,
+    ) -> Arc<MediaMetadataService> {
+        let blob_root = self.storage_path.join(".blobs");
+        Arc::new(MediaMetadataService::new(db_pool.clone(), blob_root))
+    }
+
     /// Creates the trash service
     pub async fn create_trash_service(
         &self,
@@ -1448,6 +1466,8 @@ pub struct CoreServices {
     /// Composite lifecycle dispatcher — wires thumbnails + audio metadata for all file events.
     pub file_lifecycle: Arc<FileLifecycleService>,
     pub audio_metadata_service: Option<Arc<AudioMetadataService>>,
+    /// Image/video capture-metadata extractor (EXIF + container dates).
+    pub media_metadata_service: Arc<MediaMetadataService>,
     pub chunked_upload_service: Arc<ChunkedUploadService>,
     pub image_transcode_service: Arc<ImageTranscodeService>,
     pub dedup_service: Arc<DedupService>,
@@ -1487,6 +1507,7 @@ pub struct ApplicationServices {
     pub favorites_service: Option<Arc<FavoritesService>>,
     pub recent_service: Option<Arc<RecentService>>,
     pub audio_metadata_service: Option<Arc<AudioMetadataService>>,
+    pub media_metadata_service: Arc<MediaMetadataService>,
 }
 
 /// Container for authentication services

src/common/mime_detect.rs

@@ -8,6 +8,9 @@
 //!
 //! Performance: < 1µs for the `infer` check (reads only header bytes, no allocation).
 
+use std::path::Path;
+use tokio::io::AsyncReadExt;
+
 /// Maximum bytes needed for magic-byte detection. Upload ingestion peeks
 /// this many bytes off the stream before forwarding them unchanged.
 pub const MAGIC_BYTES_LEN: usize = 8192;
@@ -53,6 +56,58 @@ pub fn refine_content_type(buf: &[u8], filename: &str, claimed: &str) -> String
     claimed.to_string()
 }
 
+/// Detect the `Content-Type` to serve for an already-encoded thumbnail.
+///
+/// The slow encode path re-encodes to JPEG, but the fast path stores the
+/// source image as-is (PNG / GIF / WebP), so the handler must not blindly
+/// claim `image/jpeg`. Detects the real format from magic bytes, defaulting
+/// to `image/jpeg` (the slow-path output) when detection is inconclusive.
+pub fn thumbnail_content_type(data: &[u8]) -> &'static str {
+    infer::get(data)
+        .map(|kind| kind.mime_type())
+        .filter(|mime| mime.starts_with("image/"))
+        .unwrap_or("image/jpeg")
+}
+
+/// Async helper: reads the first bytes of a file on disk and refines the MIME type.
+///
+/// Designed for the upload path where the file has been spooled to a temp path.
+pub async fn refine_content_type_from_file(
+    temp_path: &Path,
+    filename: &str,
+    claimed: &str,
+) -> String {
+    // Fast path: if the client gave us a specific type, trust it
+    if !claimed.is_empty()
+        && claimed != "application/octet-stream"
+        && claimed != "binary/octet-stream"
+    {
+        return claimed.to_string();
+    }
+
+    // Read only the first bytes needed for magic detection (not the whole file).
+    match tokio::fs::File::open(temp_path).await {
+        Ok(mut file) => {
+            let mut buf = vec![0u8; MAGIC_BYTES_LEN];
+            let n = file.read(&mut buf).await.unwrap_or(0);
+            refine_content_type(&buf[..n], filename, claimed)
+        }
+        Err(e) => {
+            tracing::warn!(
+                "MIME detection: failed to read {} for magic bytes: {}",
+                temp_path.display(),
+                e
+            );
+            // Fall back to extension
+            let guess = mime_guess::from_path(filename);
+            if let Some(mime) = guess.first() {
+                return mime.to_string();
+            }
+            claimed.to_string()
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -80,6 +135,20 @@ mod tests {
         assert_eq!(result, "image/jpeg");
     }
 
+    #[test]
+    fn thumbnail_content_type_detects_real_format() {
+        // Fast-path thumbnails keep the source format — serve it accurately.
+        let png = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR";
+        assert_eq!(thumbnail_content_type(png), "image/png");
+
+        let jpeg = b"\xff\xd8\xff\xe0\x00\x10JFIF";
+        assert_eq!(thumbnail_content_type(jpeg), "image/jpeg");
+
+        // Inconclusive bytes default to JPEG (the slow-path encoder output).
+        assert_eq!(thumbnail_content_type(b"garbage"), "image/jpeg");
+        assert_eq!(thumbnail_content_type(b""), "image/jpeg");
+    }
+
     #[test]
     fn binary_octet_stream_also_triggers_detection() {
         let jpeg = b"\xff\xd8\xff\xe0\x00\x10JFIF";

src/infrastructure/services/media_metadata_service.rs

@@ -0,0 +1,485 @@
+//! Capture-metadata extraction for images **and** videos.
+//!
+//! Populates `storage.file_metadata.captured_at` (and, for images, GPS / camera
+//! / orientation / dimensions) so the Photos timeline can group by the real
+//! capture date instead of the upload time. A DB trigger
+//! (`trg_sync_media_sort_date`) keeps `storage.files.media_sort_date =
+//! COALESCE(captured_at, created_at)` in sync, so writing `captured_at` is all
+//! that is needed — the query/DTO/frontend already consume it.
+//!
+//! Mirrors [`AudioMetadataService`](super::audio_metadata_service): it is a
+//! [`FileLifecycleHook`] wired into the upload pipeline, runs extraction off the
+//! Tokio workers (`spawn_blocking`), and is dedup/copy aware.
+//!
+//! - **Images** — rich EXIF via the existing [`ExifService`] (kamadak-exif:
+//!   GPS, camera, orientation, dimensions, capture date). The capture date is
+//!   then upgraded to a timezone-correct value via `nom-exif`, which parses
+//!   `OffsetTimeOriginal` (falling back to the kamadak naive value).
+//! - **Videos** — container creation time (`mov`/`mp4`/`mkv`) via `nom-exif`,
+//!   which seeks the metadata atoms (never loads the whole file) and is
+//!   timezone-aware. No EXIF exists for video.
+
+use chrono::{DateTime, FixedOffset, Utc};
+use futures::StreamExt;
+use sqlx::{FromRow, PgPool};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use tracing::{info, warn};
+use uuid::Uuid;
+
+use crate::application::ports::file_lifecycle::FileLifecycleHook;
+use crate::common::errors::DomainError;
+use crate::infrastructure::repositories::pg::file_metadata_repository::FileMetadataRepository;
+use crate::infrastructure::services::exif_service::{ExifMetadata, ExifService};
+
+#[derive(Debug, FromRow)]
+pub struct MediaFileRow {
+    pub file_id: Uuid,
+    pub blob_hash: String,
+    pub mime_type: String,
+}
+
+#[derive(Debug, serde::Serialize)]
+pub struct MetadataExtractionResult {
+    pub total: usize,
+    pub processed: usize,
+    pub failed: usize,
+}
+
+pub struct MediaMetadataService {
+    pool: Arc<PgPool>,
+    blob_root: PathBuf,
+}
+
+impl MediaMetadataService {
+    pub fn new(pool: Arc<PgPool>, blob_root: PathBuf) -> Self {
+        Self { pool, blob_root }
+    }
+
+    pub fn is_image_file(mime_type: &str) -> bool {
+        mime_type.starts_with("image/")
+    }
+
+    pub fn is_video_file(mime_type: &str) -> bool {
+        mime_type.starts_with("video/")
+    }
+
+    /// Whether this service extracts capture metadata for the given MIME type.
+    pub fn handles(mime_type: &str) -> bool {
+        Self::is_image_file(mime_type) || Self::is_video_file(mime_type)
+    }
+
+    fn blob_path(&self, hash: &str) -> PathBuf {
+        let prefix = &hash[0..2];
+        self.blob_root.join(prefix).join(format!("{}.blob", hash))
+    }
+
+    fn arc(&self) -> Arc<Self> {
+        Arc::new(Self {
+            pool: self.pool.clone(),
+            blob_root: self.blob_root.clone(),
+        })
+    }
+
+    /// Extract capture metadata from a media blob.
+    ///
+    /// All parsing is synchronous (kamadak-exif + nom-exif), so this MUST only
+    /// be called inside `spawn_blocking`. Returns `None` when there is nothing
+    /// worth persisting (no EXIF and no capture date) — the caller then skips
+    /// the upsert and the file legitimately falls back to its upload date.
+    fn extract_blocking(path: &Path, mime_type: &str) -> Option<ExifMetadata> {
+        if !path.exists() {
+            warn!("Media file does not exist: {:?}", path);
+            return None;
+        }
+
+        if Self::is_image_file(mime_type) {
+            // Rich EXIF (GPS / camera / orientation / dimensions + naive date)
+            // from the proven kamadak extractor.
+            let mut meta = std::fs::read(path)
+                .ok()
+                .and_then(|b| ExifService::extract(&b));
+            // Upgrade the capture date to a timezone-correct instant when the
+            // image carries OffsetTimeOriginal (nom-exif). Falls back to the
+            // kamadak naive value otherwise.
+            let tz_date = capture_date(path);
+            match (meta.as_mut(), tz_date) {
+                (Some(m), Some(dt)) => m.captured_at = Some(dt),
+                (Some(_), None) => { /* keep kamadak's naive captured_at */ }
+                (None, Some(dt)) => {
+                    meta = Some(ExifMetadata {
+                        captured_at: Some(dt),
+                        ..Default::default()
+                    });
+                }
+                (None, None) => {}
+            }
+            meta
+        } else if Self::is_video_file(mime_type) {
+            // Videos carry no EXIF — pull the container creation time only.
+            capture_date(path).map(|dt| ExifMetadata {
+                captured_at: Some(dt),
+                ..Default::default()
+            })
+        } else {
+            None
+        }
+    }
+
+    /// Extract metadata for one file and persist it (no-op when nothing useful
+    /// could be extracted).
+    pub async fn extract_and_save(
+        &self,
+        file_id: &Uuid,
+        file_path: &Path,
+        mime_type: &str,
+    ) -> Result<(), DomainError> {
+        let path = file_path.to_path_buf();
+        let mime = mime_type.to_string();
+        let meta = tokio::task::spawn_blocking(move || Self::extract_blocking(&path, &mime))
+            .await
+            .map_err(|e| {
+                DomainError::internal_error(
+                    "MediaMetadataService",
+                    format!("spawn_blocking join error: {e}"),
+                )
+            })?;
+
+        let Some(meta) = meta else {
+            return Ok(());
+        };
+
+        FileMetadataRepository::new(self.pool.clone())
+            .upsert(&file_id.to_string(), &meta)
+            .await?;
+        info!(
+            "Saved capture metadata for file {} (captured_at={:?})",
+            file_id, meta.captured_at
+        );
+        Ok(())
+    }
+
+    pub async fn delete_metadata(&self, file_id: &Uuid) -> Result<(), DomainError> {
+        sqlx::query("DELETE FROM storage.file_metadata WHERE file_id = $1")
+            .bind(file_id)
+            .execute(&*self.pool)
+            .await
+            .map_err(|e| {
+                DomainError::database_error(format!("Failed to delete file metadata: {}", e))
+            })?;
+        Ok(())
+    }
+
+    pub fn spawn_extraction_background(
+        service: Arc<Self>,
+        file_id: Uuid,
+        file_path: PathBuf,
+        mime_type: String,
+    ) {
+        tokio::spawn(async move {
+            tracing::info!("📷 Extracting capture metadata for: {}", file_id);
+            if let Err(e) = service
+                .extract_and_save(&file_id, &file_path, &mime_type)
+                .await
+            {
+                tracing::warn!("Failed to extract capture metadata: {}", e);
+            }
+        });
+    }
+
+    pub fn spawn_extraction_with_delete_background(
+        service: Arc<Self>,
+        file_id: Uuid,
+        file_path: PathBuf,
+        mime_type: String,
+    ) {
+        tokio::spawn(async move {
+            tracing::info!("📷 Updating capture metadata for: {}", file_id);
+            let _ = service.delete_metadata(&file_id).await;
+            if let Err(e) = service
+                .extract_and_save(&file_id, &file_path, &mime_type)
+                .await
+            {
+                tracing::warn!("Failed to update capture metadata: {}", e);
+            }
+        });
+    }
+
+    /// Clone metadata from a known source file (explicit copy); falls back to a
+    /// blob-hash lookup or fresh extraction if the source is not yet processed.
+    pub fn clone_from_source_background(
+        service: Arc<Self>,
+        new_file_id: Uuid,
+        source_file_id: Uuid,
+        blob_hash: String,
+        mime_type: String,
+    ) {
+        tokio::spawn(async move {
+            let result = sqlx::query(
+                r#"
+                INSERT INTO storage.file_metadata
+                    (file_id, captured_at, latitude, longitude, camera_make,
+                     camera_model, orientation, width, height)
+                SELECT $1, captured_at, latitude, longitude, camera_make,
+                       camera_model, orientation, width, height
+                FROM storage.file_metadata
+                WHERE file_id = $2
+                ON CONFLICT (file_id) DO NOTHING
+                "#,
+            )
+            .bind(new_file_id)
+            .bind(source_file_id)
+            .execute(&*service.pool)
+            .await;
+
+            match result {
+                Ok(r) if r.rows_affected() > 0 => {
+                    info!(
+                        "Cloned capture metadata from {} to {}",
+                        source_file_id, new_file_id
+                    );
+                }
+                Ok(_) => {
+                    Self::clone_or_extract_background(service, new_file_id, blob_hash, mime_type);
+                }
+                Err(e) => {
+                    warn!(
+                        "Failed to clone capture metadata from {} to {}: {}",
+                        source_file_id, new_file_id, e
+                    );
+                }
+            }
+        });
+    }
+
+    /// Clone metadata from any file sharing the same blob; falls back to fresh
+    /// extraction if no processed sibling exists yet.
+    pub fn clone_or_extract_background(
+        service: Arc<Self>,
+        new_file_id: Uuid,
+        blob_hash: String,
+        mime_type: String,
+    ) {
+        tokio::spawn(async move {
+            let rows_inserted = sqlx::query(
+                r#"
+                INSERT INTO storage.file_metadata
+                    (file_id, captured_at, latitude, longitude, camera_make,
+                     camera_model, orientation, width, height)
+                SELECT $1, fm.captured_at, fm.latitude, fm.longitude, fm.camera_make,
+                       fm.camera_model, fm.orientation, fm.width, fm.height
+                FROM storage.file_metadata fm
+                JOIN storage.files sf ON sf.id = fm.file_id
+                WHERE sf.blob_hash = $2
+                LIMIT 1
+                ON CONFLICT (file_id) DO NOTHING
+                "#,
+            )
+            .bind(new_file_id)
+            .bind(&blob_hash)
+            .execute(&*service.pool)
+            .await;
+
+            match rows_inserted {
+                Ok(result) if result.rows_affected() > 0 => {
+                    info!("Cloned capture metadata for file {}", new_file_id);
+                }
+                Ok(_) => {
+                    let file_path = service.blob_path(&blob_hash);
+                    if let Err(e) = service
+                        .extract_and_save(&new_file_id, &file_path, &mime_type)
+                        .await
+                    {
+                        warn!(
+                            "Failed to extract capture metadata for {}: {}",
+                            new_file_id, e
+                        );
+                    }
+                }
+                Err(e) => {
+                    warn!(
+                        "Failed to clone capture metadata for {}: {}",
+                        new_file_id, e
+                    );
+                }
+            }
+        });
+    }
+
+    /// Backfill: re-extract capture metadata for every existing image/video.
+    /// Streams rows (O(1) memory); failures are logged and skipped, never abort
+    /// the batch. Each upsert fires the DB trigger that recomputes
+    /// `media_sort_date`, so the Photos timeline re-buckets afterwards.
+    pub async fn reextract_all_image_metadata(
+        &self,
+    ) -> Result<MetadataExtractionResult, DomainError> {
+        let mut stream = sqlx::query_as::<_, MediaFileRow>(
+            r#"
+            SELECT id as file_id, blob_hash, mime_type
+            FROM storage.files
+            WHERE mime_type LIKE 'image/%' OR mime_type LIKE 'video/%'
+            "#,
+        )
+        .fetch(&*self.pool);
+
+        let mut total: usize = 0;
+        let mut processed: usize = 0;
+        let mut failed: usize = 0;
+
+        info!("Starting streaming capture-metadata backfill for image/video files");
+
+        while let Some(row) = stream.next().await {
+            total += 1;
+            let media = row.map_err(|e| {
+                DomainError::database_error(format!("Failed to fetch media file row: {}", e))
+            })?;
+            let file_path = self.blob_path(&media.blob_hash);
+            match self
+                .extract_and_save(&media.file_id, &file_path, &media.mime_type)
+                .await
+            {
+                Ok(()) => processed += 1,
+                Err(e) => {
+                    warn!(
+                        "Failed to extract capture metadata for file {}: {}",
+                        media.file_id, e
+                    );
+                    failed += 1;
+                }
+            }
+        }
+
+        info!(
+            "Capture-metadata backfill complete: {} processed, {} failed out of {} total",
+            processed, failed, total
+        );
+
+        Ok(MetadataExtractionResult {
+            total,
+            processed,
+            failed,
+        })
+    }
+}
+
+/// Extract a timezone-correct capture instant from an image (EXIF
+/// `DateTimeOriginal`/`CreateDate`) or video/audio container (`CreateDate`).
+///
+/// `nom-exif` returns an offset-aware `DateTime<FixedOffset>` when the file
+/// carries `OffsetTimeOriginal` (or a tz-aware container time); when it does
+/// not, the naive wall-clock is interpreted as UTC. Either way the result is
+/// converted to a true UTC instant. Returns `None` if no capture date exists.
+fn capture_date(path: &Path) -> Option<DateTime<Utc>> {
+    use nom_exif::{EntryValue, ExifTag, TrackInfoTag, read_exif, read_track};
+
+    let to_utc = |ev: &EntryValue| -> Option<DateTime<Utc>> {
+        let edt = ev.as_datetime()?;
+        let utc0 = FixedOffset::east_opt(0)?;
+        Some(edt.or_offset(utc0).with_timezone(&Utc))
+    };
+
+    // Images: EXIF DateTimeOriginal, then DateTimeDigitized (CreateDate).
+    if let Ok(exif) = read_exif(path) {
+        if let Some(dt) = exif.get(ExifTag::DateTimeOriginal).and_then(to_utc) {
+            return Some(dt);
+        }
+        if let Some(dt) = exif.get(ExifTag::CreateDate).and_then(to_utc) {
+            return Some(dt);
+        }
+    }
+
+    // Videos / audio containers (mov/mp4/mkv): track creation time.
+    if let Ok(track) = read_track(path)
+        && let Some(dt) = track.get(TrackInfoTag::CreateDate).and_then(to_utc)
+    {
+        return Some(dt);
+    }
+
+    None
+}
+
+// ─── FileLifecycleHook ───────────────────────────────────────────────────────
+
+impl FileLifecycleHook for MediaMetadataService {
+    fn on_file_created(
+        &self,
+        file_id: &str,
+        blob_hash: &str,
+        content_type: &str,
+        is_new_blob: bool,
+    ) {
+        if !Self::handles(content_type) {
+            return;
+        }
+        let Ok(uuid) = file_id.parse::<Uuid>() else {
+            warn!("on_file_created: invalid file_id UUID: {}", file_id);
+            return;
+        };
+        let service = self.arc();
+        if is_new_blob {
+            Self::spawn_extraction_background(
+                service,
+                uuid,
+                self.blob_path(blob_hash),
+                content_type.to_string(),
+            );
+        } else {
+            Self::clone_or_extract_background(
+                service,
+                uuid,
+                blob_hash.to_string(),
+                content_type.to_string(),
+            );
+        }
+    }
+
+    fn on_file_copied(
+        &self,
+        file_id: &str,
+        blob_hash: &str,
+        content_type: &str,
+        source_file_id: &str,
+    ) {
+        if !Self::handles(content_type) {
+            return;
+        }
+        let Ok(uuid) = file_id.parse::<Uuid>() else {
+            warn!("on_file_copied: invalid file_id UUID: {}", file_id);
+            return;
+        };
+        let Ok(source_uuid) = source_file_id.parse::<Uuid>() else {
+            warn!(
+                "on_file_copied: invalid source_file_id UUID: {}",
+                source_file_id
+            );
+            return;
+        };
+        Self::clone_from_source_background(
+            self.arc(),
+            uuid,
+            source_uuid,
+            blob_hash.to_string(),
+            content_type.to_string(),
+        );
+    }
+
+    fn on_file_updated(&self, file_id: &str, blob_hash: &str, content_type: &str) {
+        if !Self::handles(content_type) {
+            return;
+        }
+        let Ok(uuid) = file_id.parse::<Uuid>() else {
+            warn!("on_file_updated: invalid file_id UUID: {}", file_id);
+            return;
+        };
+        Self::spawn_extraction_with_delete_background(
+            self.arc(),
+            uuid,
+            self.blob_path(blob_hash),
+            content_type.to_string(),
+        );
+    }
+
+    fn on_file_deleted(&self, _file_id: &str) {
+        // storage.file_metadata has ON DELETE CASCADE on file_id — DB handles cleanup.
+    }
+}

src/infrastructure/services/mod.rs

@@ -12,6 +12,7 @@ pub mod image_transcode_service;
 pub mod jwt_service;
 pub mod local_blob_backend;
 pub mod login_lockout_service;
+pub mod media_metadata_service;
 pub mod migration_blob_backend;
 pub mod migration_job;
 pub mod mock_email_sender;

src/interfaces/api/handlers/admin_handler.rs

@@ -58,6 +58,8 @@ pub fn admin_routes() -> Router<Arc<AppState>> {
         .route("/settings/registration", put(set_registration_setting))
         // Audio metadata
         .route("/audio/metadata/reextract", post(reextract_audio_metadata))
+        // Image/video capture metadata (Photos timeline backfill)
+        .route("/photos/metadata/reextract", post(reextract_image_metadata))
         // SMTP diagnostics
         .route("/smtp/info", get(get_smtp_info))
         .route("/smtp/test", post(send_smtp_test))
@@ -1216,6 +1218,32 @@ async fn reextract_audio_metadata(
     })))
 }
 
+/// Backfill image/video capture dates (EXIF / container creation time) into
+/// `storage.file_metadata` for every existing media file, re-bucketing the
+/// Photos timeline by real capture date. Safe to re-run (idempotent upsert).
+async fn reextract_image_metadata(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+) -> Result<impl IntoResponse, AppError> {
+    admin_guard(&state, &headers).await?;
+
+    let result = state
+        .applications
+        .media_metadata_service
+        .reextract_all_image_metadata()
+        .await
+        .map_err(|e| {
+            AppError::internal_error(format!("Failed to re-extract capture metadata: {}", e))
+        })?;
+
+    Ok(Json(serde_json::json!({
+        "message": "Image/video capture-metadata extraction complete",
+        "total": result.total,
+        "processed": result.processed,
+        "failed": result.failed,
+    })))
+}
+
 // ─────────────────────────────────────────────────────
 // SMTP diagnostics
 // ─────────────────────────────────────────────────────

src/interfaces/api/handlers/file_handler.rs

@@ -370,7 +370,10 @@ impl FileHandler {
         {
             return Response::builder()
                 .status(StatusCode::OK)
-                .header(header::CONTENT_TYPE, "image/jpeg")
+                .header(
+                    header::CONTENT_TYPE,
+                    crate::common::mime_detect::thumbnail_content_type(&data),
+                )
                 .header(header::CONTENT_LENGTH, data.len())
                 .header(header::CACHE_CONTROL, "public, max-age=31536000, immutable")
                 .header(header::ETAG, &etag)
@@ -420,7 +423,10 @@ impl FileHandler {
         {
             return Response::builder()
                 .status(StatusCode::OK)
-                .header(header::CONTENT_TYPE, "image/jpeg")
+                .header(
+                    header::CONTENT_TYPE,
+                    crate::common::mime_detect::thumbnail_content_type(&data),
+                )
                 .header(header::CONTENT_LENGTH, data.len())
                 .header(header::CACHE_CONTROL, "public, max-age=31536000, immutable")
                 .header(header::ETAG, &etag)
@@ -440,7 +446,10 @@ impl FileHandler {
         {
             Ok(data) => Response::builder()
                 .status(StatusCode::OK)
-                .header(header::CONTENT_TYPE, "image/jpeg")
+                .header(
+                    header::CONTENT_TYPE,
+                    crate::common::mime_detect::thumbnail_content_type(&data),
+                )
                 .header(header::CONTENT_LENGTH, data.len())
                 .header(header::CACHE_CONTROL, "public, max-age=31536000, immutable")
                 .header(header::ETAG, &etag)