Add photo management for models and employees; fix stale detail navigation

Model photos: upload/replace/delete on /api/models/<id>/image (admin),
stored under instance/modelimages/ with a public serve route; thumbnail
plus Upload/Replace/Remove controls in the Models settings modal; the
URL field remains as a manual alternative.

Employee photos, mode-aware: self-hosted directory employees get
upload/replace/delete (photo-<sso> under instance/employeephotos/,
employees plugin migration 0002); external directory mode passes the
HR-supplied picture URL through read-only (writes 409). One resolver
feeds both consumers - the shopfloor recognition/recert kiosk cards and
the employee detail hero - in either mode.

Navigation fix: router-view is keyed on route path, so following a
relationship link between two assets of the same type (machine ->
dualpath machine) reloads the page instead of showing stale content;
query-only URL changes still avoid a remount.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plugins/notifications/api/routes.py

@@ -8,7 +8,7 @@ from zoneinfo import ZoneInfo
 from flask import Blueprint, request
 from flask_jwt_extended import jwt_required
 
-from shopdb.api import db, success_response, error_response, paginated_response, ErrorCodes, get_pagination_params, paginate_query, employee_connection
+from shopdb.api import db, success_response, error_response, paginated_response, ErrorCodes, get_pagination_params, paginate_query
 
 from ..models import Notification, NotificationType
 
@@ -150,16 +150,12 @@ def _config_version():
 
 
 def _employee_picture(sso):
-    """Best-effort Picture blob for an SSO from the HR directory. None on any miss."""
-    if not (sso and str(sso).isdigit()):
-        return None
+    """Resolved display photo URL for an SSO, via the shared employees-plugin
+    resolver so kiosk cards match EmployeeDetail in both directory modes
+    (self-hosted upload URL or external HR URL). None on any miss."""
     try:
-        conn = employee_connection()
-        with conn.cursor() as cur:
-            cur.execute('SELECT Picture FROM employees WHERE SSO = %s', (int(sso),))
-            emp = cur.fetchone()
-        conn.close()
-        return emp.get('Picture') if emp else None
+        from plugins.employees.api.routes import resolve_employee_photo_url
+        return resolve_employee_photo_url(sso)
     except Exception:
         return None