feat(providers): account calls (auth/refresh/credits) egress on the local IP

Now only the generate/video submit uses proxy.url; cookie-exchange/login, token refresh, credit-balance and project/session bootstrap all go direct. Also splits adobe GenerateVideo (submit=proxy, poll/download=local). Verified live: adobe gpt 1K cookie-exchange via local IP, submit 23.244.30.102 (proxy) vs local 76.209.9.65, 2.0MB PNG. Build+vet pass.

backend/internal/provider/krea/image.go

@@ -22,7 +22,7 @@ const (
 // ensureProject returns a flux project id for the account: the first existing
 // project, or a freshly created one. Generation requires a project.
 func (c *Client) ensureProject(ctx context.Context, cookie string) (string, error) {
-	body, status, err := c.apiGet(ctx, cookie, "/api/flux-projects")
+	body, status, err := c.apiGetP(ctx, cookie, "/api/flux-projects", false)
 	if err != nil {
 		return "", fmt.Errorf("%w: list projects: %s", ErrTemporaryUpstream, err.Error())
 	}
@@ -309,6 +309,7 @@ func (c *Client) apiPostP(ctx context.Context, cookie, path, contentType string,
 }
 
 func (c *Client) apiPostJSON(ctx context.Context, cookie, path string, payload any) ([]byte, int, error) {
+	// project bootstrap runs on the local IP; only the generate submit uses the proxy.
 	b, _ := json.Marshal(payload)
-	return c.apiPost(ctx, cookie, path, "application/json", b)
+	return c.apiPostP(ctx, cookie, path, "application/json", b, false)
 }