Add photo management for models and employees; fix stale detail navigation

Model photos: upload/replace/delete on /api/models/<id>/image (admin),
stored under instance/modelimages/ with a public serve route; thumbnail
plus Upload/Replace/Remove controls in the Models settings modal; the
URL field remains as a manual alternative.

Employee photos, mode-aware: self-hosted directory employees get
upload/replace/delete (photo-<sso> under instance/employeephotos/,
employees plugin migration 0002); external directory mode passes the
HR-supplied picture URL through read-only (writes 409). One resolver
feeds both consumers - the shopfloor recognition/recert kiosk cards and
the employee detail hero - in either mode.

Navigation fix: router-view is keyed on route path, so following a
relationship link between two assets of the same type (machine ->
dualpath machine) reloads the page instead of showing stale content;
query-only URL changes still avoid a remount.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plugins/employees/models/directory_employee.py

@@ -6,6 +6,11 @@ external directory, and the directory is managed in-app (CRUD + CSV import).
 
 to_dict emits the same keys the external contract returns (SSO, First_Name,
 Last_Name, Team, Role, Picture) so the frontend and both modes share one shape.
+
+photofilename holds the basename of an uploaded photo (photo-<sso><ext>) served
+from instance/employeephotos/. It is distinct from the legacy Picture text
+field: in self-hosted mode the displayed photo comes from uploads (photofilename)
+via the shared resolver, not from Picture.
 """
 
 from shopdb.api import db
@@ -20,9 +25,13 @@ class DirectoryEmployee(db.Model):
     team = db.Column(db.String(100))
     role = db.Column(db.String(100))
     picture = db.Column(db.String(255))
+    # basename of an uploaded photo (photo-<sso><ext>); None when no upload
+    photofilename = db.Column(db.String(255))
 
     def to_dict(self):
         # Keys match the external employees contract the frontend consumes.
+        # photofilename is extra (self-hosted upload); the resolved display URL
+        # is added as photourl by the API layer via resolve_employee_photo_url.
         return {
             'SSO': self.sso,
             'First_Name': self.firstname,
@@ -30,4 +39,5 @@ class DirectoryEmployee(db.Model):
             'Team': self.team,
             'Role': self.role,
             'Picture': self.picture,
+            'photofilename': self.photofilename,
         }