Versioned template store + re-enroll flow

[vhrabar]

Description

Switching dlib -> SFace changes the embedding space, so old templates become invalid. Replace the untyped model_store.py with a versioned store that stamps each template with the producing model and refuses cross-space comparison, plus a re-enroll path so users regenerate templates once.

Tasks

• auth/template_store.py: on-disk shape {model_id, dim, created, embeddings: [...]}
• Loader ignores/rejects templates whose model_id ≠ active recognizer, with an actionable error
• model_store.py becomes a thin shim delegating to the new store
• cli re-enroll command (regenerate a user's templates under the active model)
• Clear "re-enroll required" message surfaced through the auth/CLI path

Acceptance criteria

• Legacy templates still load and match under pipeline=legacy
• ONNX path refuses mismatched-model_id templates instead of silently mis-scoring
• Re-enroll writes v2 templates that authenticate successfully