feat(providers): account calls (auth/refresh/credits) egress on the local IP

Now only the generate/video submit uses proxy.url; cookie-exchange/login, token refresh, credit-balance and project/session bootstrap all go direct. Also splits adobe GenerateVideo (submit=proxy, poll/download=local). Verified live: adobe gpt 1K cookie-exchange via local IP, submit 23.244.30.102 (proxy) vs local 76.209.9.65, 2.0MB PNG. Build+vet pass.

backend/internal/provider/leonardo/client.go

@@ -91,7 +91,7 @@ func (c *Client) GetSession(ctx context.Context, cookie string) (*Session, error
 	}
 	c.mu.Unlock()
 
-	client, err := c.newTLSClient()
+	client, err := c.newDirectTLSClient()
 	if err != nil {
 		return nil, err
 	}
@@ -205,7 +205,7 @@ func (c *Client) FetchCreditsBalance(ctx context.Context, cookie string) (map[st
 		"variables":     map[string]any{"sub": sess.CognitoSub},
 		"query":         qGetTokens,
 	})
-	body, status, err := c.graphql(ctx, sess.AccessToken, payload)
+	body, status, err := c.graphqlP(ctx, sess.AccessToken, payload, false)
 	if err != nil {
 		return unknownBalance("network: " + err.Error()), nil
 	}