feat: add a REST thumbnail backfill job, resolve connections in the kernel from the CLI, share the project pre-label loop

[JArmandoAnaya]

What

Closes the last three gaps in the REST/CLI/MCP alignment tracked in #884.

• REST thumbnail backfill: POST /projects/{project_id}/thumbnail-backfill-jobs enqueues an assets.backfill_thumbnails background job (202, Location, BackgroundJobOut). The job result is the same projection the CLI and MCP print. A second launch while a pass for the project is queued or running returns that job. The thumbnail route's THUMBNAIL_NOT_CACHED docs now point at this route.
• CLI connection lookup: the CLI resolves a connection through InferenceConnectionService.resolve; the private _resolve is gone. Tests pin the same error code, message and exit code (text and --json) for an unknown name or id across nine commands.
• Shared pre-label loop: cli/projects.py and mcp/batches.py share pre_label_selection in visionset.inference.prelabel. Each surface keeps its own progress and output. Refusals still happen before the first forward pass, and neither surface passes replace_model_labels.

Addresses the remaining findings of #884; the tracker is left open for a person to close.

Notes for review

• An unknown connection id is now refused when it is resolved, not inside the callee. The only visible change is when two things are wrong at once: batch pre-label with an unknown connection id and a draft or missing batch now reports the connection, which matches MCP and REST. A test pins it.
• openapi.json and frontend/ui-core/src/generated/ are regenerated, not hand-edited.

Verification

• scripts/check.sh --fast: Python suite 5035 passed; frontend suites, lint-imports (6 contracts kept), the generated-client drift check and the docs gates pass. The OpenAPI drift step failed only while the regenerated file was uncommitted; re-exporting after the commit leaves the tree clean.
• Browser suites were not run locally.