test: repair serial-bucket quick wins and quarantine intractable specs (phase 4b)

Repairs (74 tests across 6 files):
- rbac.spec.ts, settings.spec.ts: fix obsolete auth-state path
  (test-results/.auth/user.json -> .playwright/.auth/user.json via
  authFile import from playwright.config.ts)
- state-bleed-audit.spec.ts, gui-file-carry.spec.ts, full-session.spec.ts:
  update bare tool routes (/resize -> /image/resize, etc.) to match the
  2.0 /:modality/:toolId routing
- gui-settings-rbac.spec.ts: fix 2 tests with bare /resize route

Quarantine (65 tests across 2 files, tagged with test.skip()):
- gui-performance.spec.ts (62 tests): bare routes throughout + selector
  drift; mechanical route fix is tractable but needs UI verification pass
- theme.spec.ts (3 tests): footer theme toggle selector needs 2.0 UI
  verification

QUARANTINE.md updated with full triage table. Vitest parity confirmed.

tests/e2e/settings.spec.ts

@@ -1,3 +1,4 @@
+import { authFile } from "../../playwright.config";
 import { expect, openSettings, test } from "./helpers";
 
 test.describe("Settings Dialog", () => {
@@ -48,7 +49,7 @@ test.describe("Settings Dialog", () => {
   test.skip("API Keys section has generate button", async ({ browser }) => {
     // Use a fresh context to avoid dialog state from previous tests
     const context = await browser.newContext({
-      storageState: "test-results/.auth/user.json",
+      storageState: authFile,
     });
     const page = await context.newPage();
     await page.goto("/");