fix: resolve 3 pre-existing issues found during test coverage expansion

1. passport-photo 404 vs 501: add base route at /api/v1/tools/passport-photo
   that returns 501 FEATURE_NOT_INSTALLED when the AI bundle is missing,
   matching other AI tools. The /generate sub-route is Sharp-only (no
   sidecar) so it correctly skips the isToolInstalled guard.

2. AuthGuard analytics consent race: don't evaluate shouldShowConsent()
   until analyticsConfig has been fetched (guard on analyticsConfig !== null).
   Prevents redirect to /analytics-consent before config is loaded.

3. Fragile sidebar Settings selector: add openSettings(page) helper to
   E2E helpers that checks sidebar visibility with fallback to button role.
   Replace all 134 occurrences of page.locator("aside").getByText("Settings")
   across 18 test files.

tests/e2e/gui-cross-browser.spec.ts

@@ -1,5 +1,5 @@
 import { expect, type Page } from "@playwright/test";
-import { getTestImagePath, test, waitForProcessing } from "./helpers";
+import { getTestImagePath, openSettings, test, waitForProcessing } from "./helpers";
 
 // ---------------------------------------------------------------------------
 // Cross-browser smoke tests -- critical flows validated across browsers.
@@ -105,8 +105,7 @@ test.describe("Cross-browser smoke tests", () => {
     const errors = collectConsoleErrors(page);
     await page.waitForLoadState("networkidle");
 
-    await page.locator("aside").getByText("Settings").click();
-    await expect(page.getByRole("heading", { name: "General" })).toBeVisible();
+    await openSettings(page);
 
     await page.getByRole("button", { name: "About" }).click();
     await page.waitForTimeout(300);