Merge main (Photos/People/Places + ReBAC) into the SvelteKit rewrite

Bring the feature-rich main branch into the frontend Svelte rewrite
(PR #478, base bcn/frontend-svelte-rewrite). main moved well ahead of the
PR's branch point (b8a0018): it added the Places photo-map and People
(faces) backends, photos enhancements, the ReBAC→role-grants migration,
load tests, and more.

Conflicts resolved (4 files):
- Dockerfile: combine the explicit --bin allowlist (defence-in-depth from
  main) with the SPA copy from the frontend build stage (PR).
- .github/workflows/ci.yml: keep the PR's Svelte frontend job
  (svelte-check + eslint + stylelint + prettier + vitest); the legacy
  static/-targeted tsc/locale/icon advisory steps don't fit the new
  working-directory: frontend job and svelte-check supersedes them.
- justfile: keep both the new fe-* / dev recipes (PR) and the load-* k6
  recipes (main).
- static/locales: keep the PR's symlink (-> ../frontend/static/locales);
  main's new photos/people locale keys are folded into the Svelte locale
  files alongside the ported views.

Backend (people/places/faces handlers, routes, DI, migrations) merged
cleanly. `cargo check --bins` passes. The new Places/People UI is not yet
in the Svelte app; that is ported in follow-up commits.

justfile

@@ -189,3 +189,25 @@ dev:
     backend=$!
     trap 'kill $backend 2>/dev/null' EXIT INT TERM
     cd frontend && npm run dev
+
+# k6 load suite — full scenarios + regression diff vs baseline/load.json.
+# Used by the nightly workflow and on demand. Release build for fair timings.
+load:
+    bash tests/load/run.sh
+
+# k6 smoke — single happy-path iteration. PR-tier liveness check, no gate.
+load-smoke:
+    bash tests/load/smoke.sh
+
+# Re-run the full suite, then bake the latest summary into baseline/load.json.
+# The leading `-` lets `run.sh`'s regression-exit not abort the bake step;
+# review the diff and commit deliberately:
+#   chore(load): accept new baseline for <reason>
+load-baseline:
+    -bash tests/load/run.sh
+    node tests/load/bake-baseline.mjs
+
+# Standalone seeder (poking around in psql). Needs the test DB up:
+#   just db
+load-seed:
+    cargo run --bin load-seed -- --depth 5 --fanout 4 --files-per-leaf 3