fix: resolve 3 pre-existing issues found during test coverage expansion

1. passport-photo 404 vs 501: add base route at /api/v1/tools/passport-photo
   that returns 501 FEATURE_NOT_INSTALLED when the AI bundle is missing,
   matching other AI tools. The /generate sub-route is Sharp-only (no
   sidecar) so it correctly skips the isToolInstalled guard.

2. AuthGuard analytics consent race: don't evaluate shouldShowConsent()
   until analyticsConfig has been fetched (guard on analyticsConfig !== null).
   Prevents redirect to /analytics-consent before config is loaded.

3. Fragile sidebar Settings selector: add openSettings(page) helper to
   E2E helpers that checks sidebar visibility with fallback to button role.
   Replace all 134 occurrences of page.locator("aside").getByText("Settings")
   across 18 test files.

apps/api/src/routes/tools/passport-photo.ts

@@ -298,6 +298,27 @@ export function registerPassportPhoto(app: FastifyInstance) {
     },
   );
 
+  // ── Base route: return 501 so generic callers don't get 404 ──────
+  app.post(
+    "/api/v1/tools/passport-photo",
+    async (_request: FastifyRequest, reply: FastifyReply) => {
+      const toolId = "passport-photo";
+      if (!isToolInstalled(toolId)) {
+        const bundle = getBundleForTool(toolId);
+        return reply.status(501).send({
+          error: "Feature not installed",
+          code: "FEATURE_NOT_INSTALLED",
+          feature: TOOL_BUNDLE_MAP[toolId],
+          featureName: bundle?.name ?? toolId,
+          estimatedSize: bundle?.estimatedSize ?? "unknown",
+        });
+      }
+      return reply.status(400).send({
+        error: "Use /api/v1/tools/passport-photo/analyze or /generate",
+      });
+    },
+  );
+
   // ── Phase 2: Generate (crop + resize + tile) ─────────────────────
   app.post(
     "/api/v1/tools/passport-photo/generate",