Facade over videre's faces-labeling operations. Plain functions over an
open rusqlite::Connection, returning serde types and a shared Error.
Transport-agnostic on purpose: the axum --faces server is the in-repo
caller, but nothing here depends on it.