feat(cropper): move the Image Cropper into the tools app at /cropper

- Smart Photo Editor ported from id-image-bot: queue/by-ID picture
  loading, vue-croppa editing, carvekit background cleanup, nodered
  review flow, a2loft save — restyled to the tools design language
- unified login: YOUreka session identity, phone prefilled, OTP only at
  save (a2loft's requirement); artist-login step removed
- crop_image @ domain:idid OpenFGA gate on every cropper route: cached
  5-min on reads, live on save, fail closed
- credentials (minio/azure/nodered/carvekit) via env, sole exception to
  hardcoded config; 503 when unconfigured; native FormData replaces
  form-data; new deps minio + azure-storage
- 10 new tests (35 total) with fake minio/queue/nodered/removebg/a2loft

tools/.env.example

@@ -0,0 +1,9 @@
+# Image Cropper service credentials — the ONLY environment variables this app
+# uses. Everything else (URLs, port, domain catalog) is hardcoded in source.
+# Without these the rest of the app works and /cropper answers 503.
+MINIO_ACCESS_KEY=
+MINIO_SECRET_KEY=
+AZURE_STORAGE_CONNECTION_STRING=
+NODERED_HTTP_USERNAME=
+NODERED_HTTP_PASSWORD=
+CARVEKIT_API_KEY=