fix: resolve 3 pre-existing issues found during test coverage expansion

1. passport-photo 404 vs 501: add base route at /api/v1/tools/passport-photo
   that returns 501 FEATURE_NOT_INSTALLED when the AI bundle is missing,
   matching other AI tools. The /generate sub-route is Sharp-only (no
   sidecar) so it correctly skips the isToolInstalled guard.

2. AuthGuard analytics consent race: don't evaluate shouldShowConsent()
   until analyticsConfig has been fetched (guard on analyticsConfig !== null).
   Prevents redirect to /analytics-consent before config is loaded.

3. Fragile sidebar Settings selector: add openSettings(page) helper to
   E2E helpers that checks sidebar visibility with fallback to button role.
   Replace all 134 occurrences of page.locator("aside").getByText("Settings")
   across 18 test files.

tests/e2e/people.spec.ts

@@ -1,5 +1,5 @@
 import { test as base, expect } from "@playwright/test";
-import { test as uiTest } from "./helpers";
+import { openSettings, test as uiTest } from "./helpers";
 
 const API = process.env.API_URL || "http://localhost:13490";
 
@@ -323,7 +323,7 @@ base.describe("People Management — API", () => {
 
 uiTest.describe("People Management — UI", () => {
   uiTest("People section displays user count and table", async ({ loggedInPage: page }) => {
-    await page.locator("aside").getByText("Settings").click();
+    await openSettings(page);
     await page.getByRole("button", { name: /people/i }).click();
     await page.waitForTimeout(500);
 
@@ -342,7 +342,7 @@ uiTest.describe("People Management — UI", () => {
   });
 
   uiTest("Search filters users", async ({ loggedInPage: page }) => {
-    await page.locator("aside").getByText("Settings").click();
+    await openSettings(page);
     await page.getByRole("button", { name: /people/i }).click();
     await page.waitForTimeout(500);
 
@@ -356,7 +356,7 @@ uiTest.describe("People Management — UI", () => {
   });
 
   uiTest("Add Members button is visible and interactive", async ({ loggedInPage: page }) => {
-    await page.locator("aside").getByText("Settings").click();
+    await openSettings(page);
     await page.getByRole("button", { name: /people/i }).click();
     await page.waitForTimeout(500);
 
@@ -380,7 +380,7 @@ uiTest.describe("People Management — UI", () => {
   uiTest(
     "Three-dot menu shows edit, reset password, and delete options",
     async ({ loggedInPage: page }) => {
-      await page.locator("aside").getByText("Settings").click();
+      await openSettings(page);
       await page.getByRole("button", { name: /people/i }).click();
       await page.waitForTimeout(500);