fix: QA sweep fixes across migration, security, lint, and e2e tests

- fix(db): migration 0012 column order mismatch causing NOT NULL
  constraint failure on existing databases; use explicit column
  mapping instead of SELECT *
- fix(db): disable FK checks during migrations to allow SQLite
  table-recreation pattern (DROP + RENAME)
- fix(security): filter cookie_secret and instance_id from settings
  API response for non-admin users
- fix(lint): resolve all 7 API lint warnings (noParameterAssign,
  noImplicitAnyLet) in compose, image-enhancement, and workspace
- fix(docs): correct permission count from 16 to 14 in CLAUDE.md
- fix(e2e): resolve 44 Playwright test failures across 8 spec files
  including locator specificity, compress mode defaults, format count,
  restore-photo UI drift, stitch image count, GIF animated fixtures,
  submit button timing, and processing timeouts

apps/api/drizzle/0012_make_password_hash_nullable.sql

@@ -1,5 +1,6 @@
 -- Make password_hash nullable to support OIDC-only users (no local password).
 -- SQLite does not support ALTER COLUMN, so we must recreate the table.
+DROP TABLE IF EXISTS `users_new`;--> statement-breakpoint
 CREATE TABLE `users_new` (
 	`id` text PRIMARY KEY NOT NULL,
 	`username` text NOT NULL,
@@ -16,7 +17,9 @@ CREATE TABLE `users_new` (
 	`analytics_consent_shown_at` integer,
 	`analytics_consent_remind_at` integer
 );--> statement-breakpoint
-INSERT INTO `users_new` SELECT * FROM `users`;--> statement-breakpoint
+INSERT INTO `users_new` (`id`, `username`, `password_hash`, `role`, `team`, `must_change_password`, `auth_provider`, `external_id`, `email`, `created_at`, `updated_at`, `analytics_enabled`, `analytics_consent_shown_at`, `analytics_consent_remind_at`)
+SELECT `id`, `username`, `password_hash`, `role`, `team`, `must_change_password`, `auth_provider`, `external_id`, `email`, `created_at`, `updated_at`, `analytics_enabled`, `analytics_consent_shown_at`, `analytics_consent_remind_at`
+FROM `users`;--> statement-breakpoint
 DROP TABLE `users`;--> statement-breakpoint
 ALTER TABLE `users_new` RENAME TO `users`;--> statement-breakpoint
 CREATE UNIQUE INDEX `users_username_unique` ON `users` (`username`);