feat(providers): route only the generate submit through the proxy

Extends the adobe split to leonardo, krea, imagine, runway (image+video) and chatgpt: reference-image upload, polling and result download egress on the local IP; only the generate/task-create submit uses proxy.url. chatgpt keeps its anti-bot-guarded submit+upload phase on the proxy and moves only the existing second (poll/resolve/download) session to local. custom is already direct. Build+vet pass; adobe verified live, the other providers are code-complete but not yet live-tested (no dev accounts).

backend/internal/provider/leonardo/image.go

@@ -57,7 +57,7 @@ func (c *Client) uploadInitImage(ctx context.Context, accessToken string, img []
 		"query":         mUploadImage,
 		"variables":     map[string]any{"uploadImageInput": map[string]any{"uploadType": "INIT", "extension": "png"}},
 	})
-	body, status, err := c.graphql(ctx, accessToken, payload)
+	body, status, err := c.graphqlP(ctx, accessToken, payload, false)
 	if err != nil {
 		return "", fmt.Errorf("%w: upload-init: %s", ErrTemporaryUpstream, err.Error())
 	}
@@ -106,7 +106,7 @@ func (c *Client) uploadInitImage(ctx context.Context, accessToken string, img []
 	}
 	_ = w.Close()
 
-	client, err := c.newTLSClient()
+	client, err := c.newDirectTLSClient()
 	if err != nil {
 		return "", err
 	}
@@ -256,7 +256,7 @@ func (c *Client) pollImage(ctx context.Context, accessToken, genID string) (stri
 	deadline := time.Now().Add(5 * time.Minute)
 
 	for {
-		body, status, err := c.graphql(ctx, accessToken, payload)
+		body, status, err := c.graphqlP(ctx, accessToken, payload, false)
 		if err != nil {
 			return "", fmt.Errorf("%w: poll: %s", ErrTemporaryUpstream, err.Error())
 		}