fix(images): refresh OAuth credentials and rotate accounts after 401

[Bl0ck154]

Summary

• pass the parsed image model id into quota-aware credential selection
• proactively refresh expiring OAuth credentials before image generation
• retry an upstream 401 with each remaining eligible connection at most once
• recalculate per-connection proxy context for every attempt
• share the lifecycle across both image-generation entry points while preserving no-auth providers

Fixes #9230.

Why

The chat route calls checkAndRefreshToken() before dispatch and has account fallback, but /v1/images/generations previously selected one credential and sent it unchanged. An expired access token therefore caused an immediate 401 even when its refresh token was valid or another healthy connection was available.

Validation

• node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --test tests/unit/image-generation-route.test.ts (20/20)
• npm run typecheck:core
• ESLint on all changed files
• Prettier check on all changed files
• npm run check:cycles

New route coverage verifies:

• expired Antigravity OAuth access token is refreshed and persisted before image dispatch;
• upstream 401 rotates to a second account and succeeds;
• provider-scoped image generation uses the same fallback;
• existing no-auth SD WebUI behavior remains successful.