fix(rust/face-recognition): fix SSL recursion, did mismatch, storage panic in setup_models

- upload-models-to-canister.sh: remove ssl.create_default_context override (caused
  infinite recursion); use SSL_CERT_FILE + REQUESTS_CA_BUNDLE env vars instead
- backend.did: setup_models returns variant { Ok: null; Err: text } not ()
- lib.rs: guard setup_models() with metadata check so missing files return Err
  instead of trapping the canister via storage::bytes().unwrap()

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: marc0olo

rust/face-recognition/backend/backend.did

@@ -46,7 +46,7 @@ service : {
     "clear_face_recognition_model_bytes": () -> ();
     "append_face_detection_model_bytes": (bytes: blob) -> ();
     "append_face_recognition_model_bytes": (bytes: blob) -> ();
-    "setup_models": () -> ();
+    "setup_models": () -> (variant { Ok: null; Err: text });
 
     // These endpoints are used only for testing and benchmarking.
     "run_detection": () -> (Detection) query;

rust/face-recognition/backend/src/lib.rs

@@ -130,6 +130,15 @@ fn models_ready() -> bool {
 /// this function loads them into in-memory models.
 #[ic_cdk::update]
 fn setup_models() -> Result<(), String> {
+    if std::fs::metadata(FACE_DETECTION_FILE).is_err()
+        || std::fs::metadata(FACE_RECOGNITION_FILE).is_err()
+    {
+        return Err(
+            "Model files not found — upload them first using append_face_detection_model_bytes \
+             and append_face_recognition_model_bytes"
+                .to_string(),
+        );
+    }
     setup(
         storage::bytes(FACE_DETECTION_FILE),
         storage::bytes(FACE_RECOGNITION_FILE),

rust/face-recognition/upload-models-to-canister.sh

@@ -25,11 +25,11 @@ if [ ! -f "face-recognition.onnx" ]; then
         echo "Face recognition model not found — generating with $PYTHON (this may take a few minutes)..."
         "$PYTHON" -m pip install --quiet --prefer-binary facenet-pytorch torch onnx certifi
         "$PYTHON" << 'PYEOF'
-import os, ssl, certifi
+import os, certifi
 # Python from python.org on macOS doesn't ship with root certificates;
-# point urllib at the certifi bundle so pretrained weights can be downloaded.
+# point urllib and requests at the certifi bundle so pretrained weights download.
 os.environ['SSL_CERT_FILE'] = certifi.where()
-ssl.create_default_context = lambda *a, **kw: ssl.create_default_context(cafile=certifi.where())
+os.environ['REQUESTS_CA_BUNDLE'] = certifi.where()
 import torch
 import facenet_pytorch
 resnet = facenet_pytorch.InceptionResnetV1(pretrained='vggface2').eval()