test: repair serial-bucket quick wins and quarantine intractable specs (phase 4b)

Repairs (74 tests across 6 files):
- rbac.spec.ts, settings.spec.ts: fix obsolete auth-state path
  (test-results/.auth/user.json -> .playwright/.auth/user.json via
  authFile import from playwright.config.ts)
- state-bleed-audit.spec.ts, gui-file-carry.spec.ts, full-session.spec.ts:
  update bare tool routes (/resize -> /image/resize, etc.) to match the
  2.0 /:modality/:toolId routing
- gui-settings-rbac.spec.ts: fix 2 tests with bare /resize route

Quarantine (65 tests across 2 files, tagged with test.skip()):
- gui-performance.spec.ts (62 tests): bare routes throughout + selector
  drift; mechanical route fix is tractable but needs UI verification pass
- theme.spec.ts (3 tests): footer theme toggle selector needs 2.0 UI
  verification

QUARANTINE.md updated with full triage table. Vitest parity confirmed.

tests/e2e/rbac.spec.ts

@@ -1,4 +1,5 @@
 import { test as base, expect } from "@playwright/test";
+import { authFile } from "../../playwright.config";
 import { login, openSettings } from "./helpers";
 
 const API = process.env.API_URL || "http://localhost:13490";
@@ -103,7 +104,7 @@ async function cleanupTestUser(adminToken: string): Promise<void> {
 
 base.describe("RBAC - Admin sees all tabs", () => {
   base.use({
-    storageState: "test-results/.auth/user.json",
+    storageState: authFile,
   });
 
   base.test("admin sees all settings tabs", async ({ page }) => {