Bookmark "Move to folder → Add Folder" silently demotes an InvokeAI-board album to a directory album

[lstein]

What happens

BookmarkManager.addFolderToAlbum() (photomap/frontend/static/javascript/bookmarks.js:862-880) POSTs to update_album/ with only:

{ key, name, image_paths: updatedPaths, index, umap_eps, description }

update_album (photomap/backend/routers/album.py:307-337) rebuilds the album from that payload alone:

source_type=album_data.get("source_type", "directory"),
invokeai_url=album_data.get("invokeai_url"),
invokeai_root=album_data.get("invokeai_root"),
invokeai_board_ids=album_data.get("invokeai_board_ids"),

so an InvokeAI-board album is rewritten to source_type: directory with every invokeai_* field cleared, and umap_eps reset to the 0.07 default. The YAML is rewritten before move_images rejects the operation for board albums (routers/index.py), so the damage is already persisted.

Reproduction

1. Create an InvokeAI-board-backed album.
2. Bookmark any image in it.
3. Bookmark menu → Move to folder → pick a folder outside the album → answer "Yes, Add Folder".
4. Inspect config.yaml: source_type is now directory, invokeai_root/invokeai_url/invokeai_board_ids are gone.

Why it matters

After the demotion:

• Update Index takes the directory branch and recursively scans InvokeAI's outputs/images (and, once Index InvokeAI board videos alongside board images #369 lands, outputs/videos) as ordinary directories, instead of asking InvokeAI which files belong to the board — so intermediates and other boards' assets get indexed.
• Deletions stop routing through the InvokeAI API, so files are unlinked/trashed directly and leave dangling rows in InvokeAI's database.
• The album can only be restored by hand-editing config.yaml or recreating it.

Suggested fix

Belongs in update_album, not the caller: when the stored album is an invokeai_board album, preserve source_type and the invokeai_* fields whenever the payload omits them (the same "omitted means keep what's stored" rule already applied to index and invokeai_password a few lines above), or reject a payload that would change source_type. Worth auditing the other partial-payload update_album/ callers in the frontend at the same time.

Found during an adversarial review of #369; the bug predates that PR (it reproduces on master).