Add photo management for models and employees; fix stale detail navigation

Model photos: upload/replace/delete on /api/models/<id>/image (admin),
stored under instance/modelimages/ with a public serve route; thumbnail
plus Upload/Replace/Remove controls in the Models settings modal; the
URL field remains as a manual alternative.

Employee photos, mode-aware: self-hosted directory employees get
upload/replace/delete (photo-<sso> under instance/employeephotos/,
employees plugin migration 0002); external directory mode passes the
HR-supplied picture URL through read-only (writes 409). One resolver
feeds both consumers - the shopfloor recognition/recert kiosk cards and
the employee detail hero - in either mode.

Navigation fix: router-view is keyed on route path, so following a
relationship link between two assets of the same type (machine ->
dualpath machine) reloads the page instead of showing stale content;
query-only URL changes still avoid a remount.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plugins/employees/migrations/versions/0002_employee_photofilename.py

@@ -0,0 +1,40 @@
+"""Add photofilename to directoryemployees (self-hosted employee photos).
+
+The core chain (7d16_directoryemployees) created directoryemployees WITHOUT a
+photofilename column. This plugin revision adds it, so BOTH fresh installs (core
+chain builds the table, then this adds the column) and existing installs get it.
+Guarded/idempotent: skips when the table is absent (plugin disabled) or the
+column already exists (e.g. a test DB built by db.create_all() from the model).
+
+Revision ID: employees0002photo
+Revises: employees0001anchor
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = 'employees0002photo'
+down_revision = 'employees0001anchor'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+    if 'directoryemployees' not in insp.get_table_names():
+        return
+    cols = {c['name'] for c in insp.get_columns('directoryemployees')}
+    if 'photofilename' not in cols:
+        op.add_column('directoryemployees',
+                      sa.Column('photofilename', sa.String(length=255), nullable=True))
+
+
+def downgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+    if 'directoryemployees' not in insp.get_table_names():
+        return
+    cols = {c['name'] for c in insp.get_columns('directoryemployees')}
+    if 'photofilename' in cols:
+        op.drop_column('directoryemployees', 'photofilename')