Require-photo chores: no way to attach evidence; completes without a photo

[tempus2016]

Bug

When a chore is configured with Require photo evidence, completing it from the child card never asks for a photo and the completion is recorded anyway (pending approval) with no evidence attached. There is no UI to capture or attach the photo.

Root cause

The photo-evidence feature is only half-wired:

• Backend supports it — Chore.require_photo, ChoreCompletion.photo_url, the complete_chore service accepts photo_url, coord_chores.async_complete_chore forces require_photo chores through parent approval, and the panel approval queue renders the photo thumbnail.
• Frontend does not — taskmate-child-card.js _handleComplete() calls complete_chore (or presses the per-chore button entity) directly. It never checks chore.require_photo, never offers a capture UI, and never passes photo_url. The button-entity path cannot carry a photo_url at all.

There is also no image-upload endpoint in the integration; photo_url was designed to hold a URL from an automation (e.g. camera snapshot), not a file picked in the card.

Fix (agreed design)

• In-card photo capture/upload (camera on mobile), downscaled + JPEG-compressed in-browser before upload.
• New authenticated HTTP endpoint to receive and serve photos, stored under the config dir with auto-cleanup.
• Completion blocked until a photo is attached — enforced client-side and server-side (require_photo + no photo_url + not as_parent → validation error), which also covers the button-entity/automation/Dev Tools paths.

Design doc: docs/superpowers/specs/2026-06-17-photo-evidence-capture-design.md