feat(invoke): "Use as Ref Image" button + resilient auth fallback

[lstein]

Summary

• Adds a third button to the InvokeAI metadata drawer (order: Remix, Recall, Use as Ref Image) that uploads the current image to InvokeAI via POST /api/v1/images/upload and then calls /api/v1/recall/{queue_id} with reference_images: [{image_name}]. The recall call intentionally omits strict=true so other parameters already set in InvokeAI are preserved.
• Reworks the InvokeAI JWT auth flow so PhotoMap survives a backend switching between single-user and multi-user modes without needing a restart. The first attempt always uses whatever token is cached (or none); a 401 triggers a login + retry with Bearer; a 403 received with a token in hand (the "Multiuser mode is disabled. Authentication is not required…" case) invalidates the cache and retries anonymously.
• All three drawer buttons remain gated by show_recall_buttons, so none render when no InvokeAI URL is configured.

Test plan

• pytest tests/backend — 107 pass, including 5 new auth-fallback tests (test_invoke_router.py).
• npm test — 233 pass, including new sendUseRefImage + button-click tests.
• ruff check photomap tests — clean.
• npm run lint + npm run format:check — clean.
• Manual: against a running InvokeAI in multi-user mode, "Use as Ref Image" uploads and populates a reference image without resetting other params.
• Manual: against a running InvokeAI in single-user mode with credentials still saved in PhotoMap, the first request succeeds anonymously (no 403 "Multiuser mode is disabled" error).
• Manual: restart InvokeAI from multi-user → single-user while PhotoMap holds a cached token; verify the next recall silently retries anonymously and succeeds.

🤖 Generated with Claude Code