feat(faces): domain entities, ports & no-op analyzer

Phase 2 increment 2:
- domain: Face, Person, BoundingBox, DetectedFace (512-d embeddings).
- ports: FaceAnalyzerPort (detect + embed from raw bytes; decodes internally
  so the application layer stays image/ML-crate agnostic) and FaceRepository
  (user-scoped face/person persistence).
- DTOs: PersonDto, FaceBoxDto.
- NoopFaceAnalyzer — reports is_ready()==false and returns no faces, so the
  whole People pipeline compiles and runs inert until the operator wires a
  real ONNX-backed analyzer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JW6ghFMDtnRYuYNzZhb47M

src/infrastructure/services/mod.rs

@@ -17,6 +17,7 @@ pub mod migration_blob_backend;
 pub mod migration_job;
 pub mod mock_email_sender;
 pub mod nextcloud_chunked_upload_service;
+pub mod noop_face_analyzer;
 pub mod oidc_service;
 pub mod password_hasher;
 pub mod path_resolver_service;