fix: resolve 3 pre-existing issues found during test coverage expansion

1. passport-photo 404 vs 501: add base route at /api/v1/tools/passport-photo
   that returns 501 FEATURE_NOT_INSTALLED when the AI bundle is missing,
   matching other AI tools. The /generate sub-route is Sharp-only (no
   sidecar) so it correctly skips the isToolInstalled guard.

2. AuthGuard analytics consent race: don't evaluate shouldShowConsent()
   until analyticsConfig has been fetched (guard on analyticsConfig !== null).
   Prevents redirect to /analytics-consent before config is loaded.

3. Fragile sidebar Settings selector: add openSettings(page) helper to
   E2E helpers that checks sidebar visibility with fallback to button role.
   Replace all 134 occurrences of page.locator("aside").getByText("Settings")
   across 18 test files.

apps/web/src/App.tsx

@@ -152,7 +152,11 @@ function AuthGuard({ children }: { children: React.ReactNode }) {
       storeConsent.analyticsConsentRemindAt ?? analyticsConsentRemindAt ?? null,
   };
   const serverEnabled = analyticsConfig?.enabled ?? false;
-  if (authEnabled && shouldShowConsent(effectiveConsent, serverEnabled)) {
+  if (
+    authEnabled &&
+    analyticsConfig !== null &&
+    shouldShowConsent(effectiveConsent, serverEnabled)
+  ) {
     return <Navigate to="/analytics-consent" replace />;
   }