feat: API sync and documentation audit - 100% endpoint coverage (#94)

Code quality:
- Add Zod validation to 14 route handlers that used raw JSON.parse
  (favicon, find-duplicates, barcode-read, upscale, blur-faces,
  erase-object, colorize, enhance-faces, red-eye-removal,
  remove-background/effects, auth, api-keys, roles, teams,
  analytics, settings, user-files)
- Standardize error responses to safeParse + formatZodErrors pattern
- Replace unsafe `as` type casts with schema validation

OpenAPI spec (89 -> 115 operations):
- Add 14 missing tool endpoints (adjust-colors, sharpening,
  optimize-for-web, image-enhancement, noise-removal, red-eye-removal,
  restore-photo, passport-photo, colorize, enhance-faces, image-to-base64)
- Add 12 missing non-tool endpoints (analytics, features, audit-log,
  roles, admin-health)
- Add typed error schemas for 401/403/409 responses
- Add descriptions to all path parameters
- Bump version from 0.9.0 to 1.15.9

Documentation:
- Fix 8 incorrect env var defaults in configuration guide
- Add 15 undocumented env vars to configuration guide
- Fix tool ID mismatch (color-adjustments -> adjust-colors)
- Add 4 new API sections (Roles, Audit Log, Analytics, Features)
- Add image-enhancement to AI engine reference
- Update AI tool count from 13 to 14 across all docs
- Add 6 missing doc links to README

apps/api/src/routes/analytics.ts

@@ -1,9 +1,15 @@
 import { eq } from "drizzle-orm";
 import type { FastifyInstance } from "fastify";
+import { z } from "zod";
 import { env } from "../config.js";
 import { db, schema } from "../db/index.js";
 import { requireAuth } from "../plugins/auth.js";
 
+const analyticsConsentSchema = z.object({
+  enabled: z.boolean().optional(),
+  remindLater: z.boolean().optional(),
+});
+
 export async function analyticsRoutes(app: FastifyInstance): Promise<void> {
   app.get("/api/v1/config/analytics", async () => {
     if (!env.ANALYTICS_ENABLED) {
@@ -37,14 +43,18 @@ export async function analyticsRoutes(app: FastifyInstance): Promise<void> {
     const user = requireAuth(request, reply);
     if (!user) return;
 
-    const body = request.body as {
-      enabled?: boolean;
-      remindLater?: boolean;
-    } | null;
+    const parsed = analyticsConsentSchema.safeParse(request.body ?? {});
+    if (!parsed.success) {
+      return reply.status(400).send({
+        error: parsed.error.issues.map((i) => i.message).join("; "),
+        code: "VALIDATION_ERROR",
+      });
+    }
+    const body = parsed.data;
 
     const now = new Date();
 
-    if (body?.remindLater) {
+    if (body.remindLater) {
       const remindAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);
       db.update(schema.users)
         .set({
@@ -58,7 +68,7 @@ export async function analyticsRoutes(app: FastifyInstance): Promise<void> {
       return reply.send({ ok: true, analyticsEnabled: null });
     }
 
-    const enabled = body?.enabled === true;
+    const enabled = body.enabled === true;
     db.update(schema.users)
       .set({
         analyticsEnabled: enabled,