feat: API sync and documentation audit - 100% endpoint coverage (#94)

Code quality:
- Add Zod validation to 14 route handlers that used raw JSON.parse
  (favicon, find-duplicates, barcode-read, upscale, blur-faces,
  erase-object, colorize, enhance-faces, red-eye-removal,
  remove-background/effects, auth, api-keys, roles, teams,
  analytics, settings, user-files)
- Standardize error responses to safeParse + formatZodErrors pattern
- Replace unsafe `as` type casts with schema validation

OpenAPI spec (89 -> 115 operations):
- Add 14 missing tool endpoints (adjust-colors, sharpening,
  optimize-for-web, image-enhancement, noise-removal, red-eye-removal,
  restore-photo, passport-photo, colorize, enhance-faces, image-to-base64)
- Add 12 missing non-tool endpoints (analytics, features, audit-log,
  roles, admin-health)
- Add typed error schemas for 401/403/409 responses
- Add descriptions to all path parameters
- Bump version from 0.9.0 to 1.15.9

Documentation:
- Fix 8 incorrect env var defaults in configuration guide
- Add 15 undocumented env vars to configuration guide
- Fix tool ID mismatch (color-adjustments -> adjust-colors)
- Add 4 new API sections (Roles, Audit Log, Analytics, Features)
- Add image-enhancement to AI engine reference
- Update AI tool count from 13 to 14 across all docs
- Add 6 missing doc links to README

apps/api/src/routes/teams.ts

@@ -10,16 +10,21 @@
 import { randomUUID } from "node:crypto";
 import { eq, sql } from "drizzle-orm";
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+import { z } from "zod";
 import { db, schema } from "../db/index.js";
 import { requirePermission } from "../permissions.js";
 
-function validateTeamName(name: unknown): string | null {
-  if (typeof name !== "string") return "Team name is required";
-  const trimmed = name.trim();
-  if (trimmed.length === 0) return "Team name is required";
-  if (trimmed.length > 50) return "Team name must be 50 characters or fewer";
-  return null;
-}
+const teamNameSchema = z.object({
+  name: z
+    .string({ required_error: "Team name is required" })
+    .transform((v) => v.trim())
+    .pipe(
+      z
+        .string()
+        .min(1, "Team name is required")
+        .max(50, "Team name must be 50 characters or fewer"),
+    ),
+});
 
 export async function teamsRoutes(app: FastifyInstance): Promise<void> {
   // GET /api/v1/teams — List all teams with member count (admin only)
@@ -50,14 +55,14 @@ export async function teamsRoutes(app: FastifyInstance): Promise<void> {
     const admin = requirePermission("teams:manage")(request, reply);
     if (!admin) return;
 
-    const body = request.body as { name?: string } | null;
-
-    const nameError = validateTeamName(body?.name);
-    if (nameError) {
-      return reply.status(400).send({ error: nameError, code: "VALIDATION_ERROR" });
+    const parsed = teamNameSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return reply.status(400).send({
+        error: parsed.error.issues.map((i) => i.message).join("; "),
+        code: "VALIDATION_ERROR",
+      });
     }
-
-    const trimmedName = (body?.name ?? "").trim();
+    const trimmedName = parsed.data.name;
 
     // Check for duplicate name (case-insensitive)
     const existing = db
@@ -85,19 +90,20 @@ export async function teamsRoutes(app: FastifyInstance): Promise<void> {
       if (!admin) return;
 
       const { id } = request.params;
-      const body = request.body as { name?: string } | null;
 
       const team = db.select().from(schema.teams).where(eq(schema.teams.id, id)).get();
       if (!team) {
         return reply.status(404).send({ error: "Team not found", code: "NOT_FOUND" });
       }
 
-      const nameError = validateTeamName(body?.name);
-      if (nameError) {
-        return reply.status(400).send({ error: nameError, code: "VALIDATION_ERROR" });
+      const parsed = teamNameSchema.safeParse(request.body);
+      if (!parsed.success) {
+        return reply.status(400).send({
+          error: parsed.error.issues.map((i) => i.message).join("; "),
+          code: "VALIDATION_ERROR",
+        });
       }
-
-      const trimmedName = (body?.name ?? "").trim();
+      const trimmedName = parsed.data.name;
 
       // Check for duplicate name (case-insensitive), excluding current team
       const duplicate = db