fix(fusion_clock): Photo Verification is now a real master switch (was ignored)

The global enable_photo_verification toggle only fed the portal get_settings flag;
the actual writes ignored it — the NFC kiosk gated on nfc_photo_required and the
portal on location.require_photo, so photos were captured even with the toggle OFF.
Now it's the master: OFF => no photo captured/stored anywhere (NFC kiosk config +
tap, and portal check-in); ON => per-location / NFC settings apply. Test + help
text updated. Bump 3.16.0 -> 3.16.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fusion_clock/controllers/clock_api.py

@@ -308,8 +308,11 @@ class FusionClockAPI(http.Controller):
                     'x_fclk_clock_source': source,
                 }
 
-                # Photo verification
-                if photo and location.require_photo:
+                # Photo verification — only when the global toggle is on (master);
+                # per-location require_photo refines it from there.
+                enable_photo = request.env['ir.config_parameter'].sudo().get_param(
+                    'fusion_clock.enable_photo_verification', 'False') == 'True'
+                if photo and enable_photo and location.require_photo:
                     try:
                         write_vals['x_fclk_checkin_photo'] = photo
                     except Exception: