Clean up dead code, dedupe helpers, fix the reset-password contract

- Remove server exports orphaned by the Express removal: the immich
  album-link helpers, seven route-only service exports, getFileByIdFull;
  de-export internal-only helpers (utcSuffix).
- De-duplicate verifyTripAccess (9 identical copies -> services/tripAccess.ts)
  and avatarUrl (3 -> services/avatarUrl.ts); name the bcrypt cost
  (BCRYPT_COST) and the email regex (EMAIL_REGEX). Public API unchanged.
- resetPasswordRequestSchema declared `password`, but the client sends and
  the service reads `new_password` — rename it so the contract matches and
  the client types resolve.
- Make ATLAS-013 deterministic: stub the admin-1 GeoJSON download instead of
  fetching ~4600 features from GitHub during the test (it hung the suite).

shared/src/auth/auth.schema.spec.ts

@@ -28,9 +28,9 @@ describe('loginRequestSchema', () => {
 describe('forgot/reset/change password schemas', () => {
   it('validate their required fields', () => {
     expect(forgotPasswordRequestSchema.safeParse({ email: 'a@b.c' }).success).toBe(true);
-    expect(resetPasswordRequestSchema.safeParse({ token: 't', password: 'pw' }).success).toBe(true);
-    expect(resetPasswordRequestSchema.safeParse({ token: 't', password: 'pw', mfa_code: '123456' }).success).toBe(true);
-    expect(resetPasswordRequestSchema.safeParse({ password: 'pw' }).success).toBe(false);
+    expect(resetPasswordRequestSchema.safeParse({ token: 't', new_password: 'pw' }).success).toBe(true);
+    expect(resetPasswordRequestSchema.safeParse({ token: 't', new_password: 'pw', mfa_code: '123456' }).success).toBe(true);
+    expect(resetPasswordRequestSchema.safeParse({ new_password: 'pw' }).success).toBe(false);
     expect(changePasswordRequestSchema.safeParse({ current_password: 'a', new_password: 'b' }).success).toBe(true);
     expect(changePasswordRequestSchema.safeParse({ new_password: 'b' }).success).toBe(false);
   });

shared/src/auth/auth.schema.ts

@@ -29,7 +29,9 @@ export type ForgotPasswordRequest = z.infer<typeof forgotPasswordRequestSchema>;
 
 export const resetPasswordRequestSchema = z.object({
   token: z.string(),
-  password: z.string(),
+  // The client sends `new_password` and the service reads `body.new_password`;
+  // the field was misnamed `password` here, which broke the client's typing.
+  new_password: z.string(),
   mfa_code: z.string().optional(),
 });
 export type ResetPasswordRequest = z.infer<typeof resetPasswordRequestSchema>;