fix(assets): fix 12 bugs found during code review

- Fix _hash_file_obj not restoring file position when orig_pos == 0
- Fix validate_path_within_base swallowing its own ValueError
- Guard against tags=None crash in upload_from_temp_path
- Filter is_missing references from list_references_page results
- Include Decimal in metadata filter isinstance check
- Return 403 instead of 404 for PermissionError in update/add_tags routes
- Re-disable seeder after non-blocking start with --disable-assets-autoscan
- Remove duplicate HashMismatchError/DependencyMissingError from schemas_in
- Move _emit_event outside lock in seeder resume() to prevent deadlock
- Fix total_q ignoring owner_id in list_tags_with_usage
- Capture ORM attributes before commit in resolve_asset_for_download
- Remove dead code (if mime_type is None: pass)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/assets/database/queries/asset_reference.py

@@ -141,7 +141,7 @@ def _apply_metadata_filter(
 
         if isinstance(value, bool):
             return _exists_for_pred(key, AssetReferenceMeta.val_bool == bool(value))
-        if isinstance(value, (int, float)):
+        if isinstance(value, (int, float, Decimal)):
             num = value if isinstance(value, Decimal) else Decimal(str(value))
             return _exists_for_pred(key, AssetReferenceMeta.val_num == num)
         if isinstance(value, str):
@@ -307,6 +307,7 @@ def list_references_page(
         select(AssetReference)
         .join(Asset, Asset.id == AssetReference.asset_id)
         .where(build_visible_owner_clause(owner_id))
+        .where(AssetReference.is_missing == False)  # noqa: E712
         .options(noload(AssetReference.tags))
     )
 
@@ -336,6 +337,7 @@ def list_references_page(
         .select_from(AssetReference)
         .join(Asset, Asset.id == AssetReference.asset_id)
         .where(build_visible_owner_clause(owner_id))
+        .where(AssetReference.is_missing == False)  # noqa: E712
     )
     if name_contains:
         escaped, esc = escape_sql_like_string(name_contains)

app/assets/database/queries/tags.py

@@ -315,11 +315,13 @@ def list_tags_with_usage(
         escaped, esc = escape_sql_like_string(prefix.strip().lower())
         total_q = total_q.where(Tag.name.like(escaped + "%", escape=esc))
     if not include_zero:
-        total_q = total_q.where(
-            Tag.name.in_(
-                select(AssetReferenceTag.tag_name).group_by(AssetReferenceTag.tag_name)
-            )
+        visible_tags_sq = (
+            select(AssetReferenceTag.tag_name)
+            .join(AssetReference, AssetReference.id == AssetReferenceTag.asset_reference_id)
+            .where(build_visible_owner_clause(owner_id))
+            .group_by(AssetReferenceTag.tag_name)
         )
+        total_q = total_q.where(Tag.name.in_(visible_tags_sq))
 
     rows = (session.execute(q.limit(limit).offset(offset))).all()
     total = (session.execute(total_q)).scalar_one()