feat(krea): allow Krea via managed Nous Subscription gateway

[teknium1]

Summary

Portal/Nous-Subscription users can now use Krea image generation without a BYO KREA_API_KEY — Krea routes through the managed Nous gateway like FAL already does.

Salvage of #52128 by @rob-maron, cherry-picked onto current main with authorship preserved.

Changes

• plugins/image_gen/krea: managed Nous gateway path (mirrors _resolve_managed_fal_gateway); is_available() now true via gateway when no direct key; new krea-2-medium-turbo model; style-ref URL strings coerced to {url, strength} objects (was a 422); LoRAs/moodboards fail fast with actionable errors on the managed tier; managed 4xx/429 remediation hints.
• tools/image_generation_tool.py: managed-mode routing for native krea-2-* ids → Krea plugin gateway; fal-ai/krea/v2/* stays on FAL; BYO/direct pipeline untouched.

Validation

	Result
Targeted tests (test_krea_provider.py, test_image_generation.py)	110/110 pass on current main
New header audit	Only new header is x-idempotency-key (random uuid4 per request, managed path → Nous's own gateway, billing boundary). No attribution/telemetry tag. User-Agent is pre-existing.
Routing isolation	Fires only after plugin dispatch returns None AND model is native krea-2-* AND managed gateway resolvable

Closes #52128.

Infographic

[github-actions]

🔎 Lint report: hermes/hermes-15dd1a55 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 11263 on HEAD, 11263 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5939 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.