fix: resolve 3 pre-existing issues found during test coverage expansion

1. passport-photo 404 vs 501: add base route at /api/v1/tools/passport-photo
   that returns 501 FEATURE_NOT_INSTALLED when the AI bundle is missing,
   matching other AI tools. The /generate sub-route is Sharp-only (no
   sidecar) so it correctly skips the isToolInstalled guard.

2. AuthGuard analytics consent race: don't evaluate shouldShowConsent()
   until analyticsConfig has been fetched (guard on analyticsConfig !== null).
   Prevents redirect to /analytics-consent before config is loaded.

3. Fragile sidebar Settings selector: add openSettings(page) helper to
   E2E helpers that checks sidebar visibility with fallback to button role.
   Replace all 134 occurrences of page.locator("aside").getByText("Settings")
   across 18 test files.

tests/e2e/gui-resilience.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test, uploadTestImage, waitForProcessing } from "./helpers";
+import { expect, openSettings, test, uploadTestImage, waitForProcessing } from "./helpers";
 
 // ---------------------------------------------------------------------------
 // GUI Resilience: Error handling, form validation, state reset, stability
@@ -187,10 +187,7 @@ test.describe("Change Password Form Validation", () => {
 test.describe("Add Member Form Validation", () => {
   test("adding a duplicate username shows error", async ({ loggedInPage: page }) => {
     // Open settings dialog and navigate to People section
-    await page.locator("aside").getByText("Settings").click();
-    await expect(page.locator("h2").filter({ hasText: "Settings" })).toBeVisible({
-      timeout: 5_000,
-    });
+    await openSettings(page);
 
     // Navigate to People section
     await page.getByRole("button", { name: /people/i }).click();
@@ -424,10 +421,7 @@ test.describe("Memory and Stability", () => {
       const start = Date.now();
 
       // Open settings
-      await page.locator("aside").getByText("Settings").click();
-      await expect(page.locator("h2").filter({ hasText: "Settings" })).toBeVisible({
-        timeout: 5_000,
-      });
+      await openSettings(page);
 
       const openTime = Date.now() - start;
       timings.push(openTime);