ml: evaluate insightface 1.0.1 against real antelopev2 weights

[Abhash-Chakraborty]

Why this is manual

Dependabot proposed insightface 0.7.3 → 1.0.1 in #402. It passed CI, and that means almost nothing here: insightface is only installed by the cpu and nvidia extras, backend-check runs uv sync --group dev, and no job imports it. The green checkmark covers zero lines of the package.

It is now in the Dependabot ignore list alongside torch/torchvision so it stops riding along in the majors group. Same tradeoff as those: security advisories will still raise alerts, but will not self-open a PR. Keep this issue open while that ignore exists.

What makes a major here risky

backend/src/find_api/ml/face_detector.py already works around antelopev2's packaging:

try:
    app = FaceAnalysis(name="antelopev2", providers=providers)
except AssertionError:
    logger.info("Retrying InsightFace with nested antelopev2 model layout")
    app = FaceAnalysis(name="antelopev2/antelopev2", providers=providers)

That retry exists because the release extracts ONNX files under a nested directory. Model packaging and download paths are exactly the sort of thing a 1.0 release cleans up — so the most likely breakage is the thing nothing in CI can observe.

Acceptance

• Install the cpu extra with insightface==1.0.1 and let it download antelopev2 from scratch (delete the cached weights first — a warm cache hides path changes).
• Confirm FaceAnalysis(name="antelopev2", ...) resolves without falling into the AssertionError branch, and note whether the nested-layout retry is still needed or can be deleted.
• Run face detection over a handful of real photos and check face.bbox, face.det_score, and face.embedding still have the shapes detect_faces() expects.
• Confirm embedding dimensionality is unchanged — if it moved, existing stored face vectors are invalid and this becomes a migration, not a bump.
• Check the People clustering output is comparable on the same input set before/after.
• Verify the ONNX execution-provider list still applies (resolve_execution / ctx_id), on CPU at minimum.

The embedding-dimension check is the one that matters most. If it changed, this stops being a dependency bump.

Related: #382 (torch, same ignore rationale), #397 (OCR tests skip in CI for the same install-extras reason).