fix: resolve fave/unfave cross-campaign collision and NoResultFound error

[ayushshukla1807]

Fixes #526, fixes #527.

Root cause: fave() queried Favorite only by entry_id + user, ignoring campaign_id. If the same image appeared in two campaigns, it would find the fave from the other campaign and activate it -- creating a cross-campaign state collision.

Fix: Scope the existence check to campaign_id in fave(). The round_entry lookup already happens anyway (for creating the new fave), so fetching campaign_id from it adds no extra query.

Also fixed: unfave() used .one() which raises NoResultFound if the fave was never created (e.g. due to a prior collision or partial state). Changed to .one_or_none() with an explicit guard -- unfaving something that is not faved is a no-op, not a 500 error.