fix: lock meta RMW and harden concurrent remix paths

Prevent worker/web clobbering of meta variants via flock and merge-by-id,
make filter timeouts thread-local, harden job-id/stem sanitization, migrate
TemplateResponse API, and remove the compare-bg experiment.

Co-authored-by: Cursor <cursoragent@cursor.com>

ARCHITECTURE.md

@@ -50,18 +50,18 @@ The gmic filter/blend chain is ported from an external reference script
 `make_random.py` (not in this repo). `config.POST_FILTERS` and asset lists
 under `assets/` mirror that script's behaviour.
 
-## Background removal choice
+## Background removal
 
-`compare-bg/` is a **standalone benchmark** (rembg models vs withoutbg).
-It is not part of the runtime stack. Production uses `u2net` + alpha
-matting via `app/rembg_cli.py` (see `config.REMBG_MODEL`).
+Production uses `u2net` + alpha matting via `app/rembg_cli.py`
+(see `config.REMBG_MODEL`).
 
 ## Known limitations (intentional)
 
 - **No web auth** — anyone with the link sees all jobs (event tool).
 - **Sequential worker** — one photo at a time; burst uploads queue.
-- **Meta JSON** — worker and web both read-modify-write `meta/*.json`
-  without file locking; concurrent remix during active processing can race.
+- **Meta JSON** — worker and web share `meta/*.json` via locked
+  read-modify-write (`fcntl.flock`); variants are merged by id so
+  concurrent remix during processing does not clobber entries.
 - **Incoming is append-only** — worker never deletes from `incoming/`.
 
 ## Dev / test