feat(faces): schema + feature flag for People (off by default)

First slice of Phase 2 (People / faces):
- migration: `faces` schema with `faces.persons` and `faces.faces`.
  Embeddings are stored as BYTEA (512 x f32) — no pgvector extension
  dependency; similarity is computed in-app (pgvector/VectorChord is the
  documented scale-up). Cascade deletes (by user and by source file)
  satisfy the right to erasure.
- OXICLOUD_ENABLE_FACES feature flag, OFF by default (biometric data,
  opt-in per deployment).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JW6ghFMDtnRYuYNzZhb47M

src/common/config.rs

@@ -881,6 +881,9 @@ pub struct FeaturesConfig {
     pub enable_music: bool,
     /// Lists the user's geotagged photos on a map (GET /api/photos/geo).
     pub enable_places: bool,
+    /// Face detection + identity clustering for the photo library ("People").
+    /// Biometric data — OFF by default; opt-in per deployment/user.
+    pub enable_faces: bool,
     /// Expose other OxiCloud users as a read-only "system" address book
     /// at GET /api/address-books. Set to false to hide the user directory.
     pub expose_system_users: bool,
@@ -896,6 +899,7 @@ impl Default for FeaturesConfig {
             enable_search: true,       // Enable search feature
             enable_music: true,        // Enable music feature
             enable_places: true,       // Photo map (GET /api/photos/geo + Places tab)
+            enable_faces: false,       // People/faces (biometric) — opt-in, off by default
             expose_system_users: true, // Expose OxiCloud users as address book by default
         }
     }
@@ -1387,6 +1391,12 @@ impl AppConfig {
             config.features.enable_places = val;
         }
 
+        if let Ok(enable_faces) = env::var("OXICLOUD_ENABLE_FACES").map(|v| v.parse::<bool>())
+            && let Ok(val) = enable_faces
+        {
+            config.features.enable_faces = val;
+        }
+
         // Content search (embedded Tantivy index)
         if let Ok(v) = env::var("OXICLOUD_ENABLE_CONTENT_SEARCH").map(|v| v.parse::<bool>())
             && let Ok(val) = v