POST /project/:id/tool returns 500

## Bug Report

**Severity:** Critical
**Found during:** Pre-production stack test (2026-03-26)
**Endpoint:** `POST /project/:projectId/tool`

### Description

Adding a tool to a project crashes with a 500 error. The server attempts to access `.enabled` on an undefined object.

### Steps to Reproduce

```bash
curl -X POST \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"label":"Test Tool","toolName":"test-tool","url":"https://example.com/tool","location":"sidebar"}' \
"https://dev.api.t-pen.org/project//tool"
```

### Expected

200 with tool added to project.

### Actual

```json
{"status":500,"message":"Cannot read properties of undefined (reading 'enabled')"}
```

### Analysis

The tool creation handler in `projectToolsRouter.js` accesses `.enabled` on an undefined object. Likely the project's tools configuration is not initialized before the property access. This blocks all tool management (add, toggle, remove) since toggle and remove depend on a tool having been added.

### Impact

The Interfaces `project-tools` component cannot add, toggle, or remove tools from projects. All three tool endpoints (`POST /tool`, `PUT /toggleTool`, `DELETE /tool`) are effectively broken.

### Environment

- Stack: dev.api.t-pen.org
- Tested with a freshly imported project (from IIIF v3 manifest)
- Auth: valid Auth0 JWT