fix: QA sweep fixes across migration, security, lint, and e2e tests

- fix(db): migration 0012 column order mismatch causing NOT NULL
  constraint failure on existing databases; use explicit column
  mapping instead of SELECT *
- fix(db): disable FK checks during migrations to allow SQLite
  table-recreation pattern (DROP + RENAME)
- fix(security): filter cookie_secret and instance_id from settings
  API response for non-admin users
- fix(lint): resolve all 7 API lint warnings (noParameterAssign,
  noImplicitAnyLet) in compose, image-enhancement, and workspace
- fix(docs): correct permission count from 16 to 14 in CLAUDE.md
- fix(e2e): resolve 44 Playwright test failures across 8 spec files
  including locator specificity, compress mode defaults, format count,
  restore-photo UI drift, stitch image count, GIF animated fixtures,
  submit button timing, and processing timeouts

tests/e2e/gui-tools-overlay.spec.ts

@@ -657,7 +657,8 @@ test.describe("GUI Watermark & Overlay Tools", () => {
       await page.getByRole("button", { name: /undo/i }).click();
 
       await expect(page.getByTestId("compose-submit")).toBeVisible({ timeout: 5_000 });
-      await expect(page.getByTestId("compose-download")).not.toBeVisible();
+      await expect(page.locator("#compose-x-position")).toBeVisible();
+      await expect(page.locator("#compose-y-position")).toBeVisible();
     });
 
     test("border: undo after processing returns to preset buttons", async ({