feat(providers): route only the generate submit through the proxy

Extends the adobe split to leonardo, krea, imagine, runway (image+video) and chatgpt: reference-image upload, polling and result download egress on the local IP; only the generate/task-create submit uses proxy.url. chatgpt keeps its anti-bot-guarded submit+upload phase on the proxy and moves only the existing second (poll/resolve/download) session to local. custom is already direct. Build+vet pass; adobe verified live, the other providers are code-complete but not yet live-tested (no dev accounts).

backend/internal/provider/runway/client.go

@@ -180,13 +180,19 @@ func unknownBalance(reason string) map[string]any {
 	}
 }
 
-func (c *Client) newTLSClient() (tlsclient.HttpClient, error) {
+func (c *Client) newTLSClient() (tlsclient.HttpClient, error) { return c.newTLSClientP(true) }
+
+// newDirectTLSClient egresses on the local IP (never the proxy). Used for
+// reference-image upload, polling and result download.
+func (c *Client) newDirectTLSClient() (tlsclient.HttpClient, error) { return c.newTLSClientP(false) }
+
+func (c *Client) newTLSClientP(useProxy bool) (tlsclient.HttpClient, error) {
 	options := []tlsclient.HttpClientOption{
 		tlsclient.WithTimeoutSeconds(30),
 		tlsclient.WithClientProfile(profiles.Chrome_133),
 		tlsclient.WithRandomTLSExtensionOrder(),
 	}
-	if c.proxy != "" {
+	if useProxy && c.proxy != "" {
 		options = append(options, tlsclient.WithProxyUrl(c.proxy))
 	}
 	return tlsclient.NewHttpClient(tlsclient.NewNoopLogger(), options...)

backend/internal/provider/runway/image.go

@@ -39,7 +39,13 @@ func (c *Client) GenerateImage(ctx context.Context, token, teamID, prompt, aspec
 		imageSize = "1K"
 	}
 
-	client, err := c.newTLSClient()
+	// Only the task-create (generate submit) egresses via the proxy; reference
+	// upload, polling and download run on the local IP.
+	submitClient, err := c.newTLSClient()
+	if err != nil {
+		return nil, nil, err
+	}
+	directClient, err := c.newDirectTLSClient()
 	if err != nil {
 		return nil, nil, err
 	}
@@ -50,7 +56,7 @@ func (c *Client) GenerateImage(ctx context.Context, token, teamID, prompt, aspec
 			continue
 		}
 		filename := fmt.Sprintf("ref_%s_%d.png", time.Now().UTC().Format("20060102_150405"), i+1)
-		assetID, url, upErr := c.uploadReference(ctx, client, token, teamID, filename, raw)
+		assetID, url, upErr := c.uploadReference(ctx, directClient, token, teamID, filename, raw)
 		if upErr != nil {
 			return nil, nil, upErr
 		}
@@ -61,15 +67,15 @@ func (c *Client) GenerateImage(ctx context.Context, token, teamID, prompt, aspec
 		})
 	}
 
-	taskID, err := c.createImageTask(ctx, client, token, teamID, prompt, aspectRatio, imageSize, refImages)
+	taskID, err := c.createImageTask(ctx, submitClient, token, teamID, prompt, aspectRatio, imageSize, refImages)
 	if err != nil {
 		return nil, nil, err
 	}
-	artifactURL, err := c.pollTask(ctx, client, token, teamID, taskID)
+	artifactURL, err := c.pollTask(ctx, directClient, token, teamID, taskID)
 	if err != nil {
 		return nil, nil, err
 	}
-	data, err := c.download(ctx, client, artifactURL)
+	data, err := c.download(ctx, directClient, artifactURL)
 	if err != nil {
 		return nil, nil, err
 	}

backend/internal/provider/runway/video.go

@@ -70,33 +70,39 @@ func (c *Client) GenerateVideo(ctx context.Context, token, teamID, prompt, aspec
 		return nil, nil, errors.New("runway: failed to decode first-frame image")
 	}
 
-	client, err := c.newTLSClient()
+	// Only the task-create (generate submit) egresses via the proxy; first-frame
+	// upload, polling and download run on the local IP.
+	submitClient, err := c.newTLSClient()
+	if err != nil {
+		return nil, nil, err
+	}
+	directClient, err := c.newDirectTLSClient()
 	if err != nil {
 		return nil, nil, err
 	}
 
 	filename := "frame_" + time.Now().UTC().Format("20060102_150405") + ".png"
-	previewUploadID, _, err := c.uploadFile(ctx, client, token, teamID, filename, "DATASET_PREVIEW", frame)
+	previewUploadID, _, err := c.uploadFile(ctx, directClient, token, teamID, filename, "DATASET_PREVIEW", frame)
 	if err != nil {
 		return nil, nil, err
 	}
-	datasetUploadID, _, err := c.uploadFile(ctx, client, token, teamID, filename, "DATASET", frame)
+	datasetUploadID, _, err := c.uploadFile(ctx, directClient, token, teamID, filename, "DATASET", frame)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	assetID, imageURL, err := c.createDataset(ctx, client, token, teamID, filename, datasetUploadID, previewUploadID, cfg.Width, cfg.Height)
+	assetID, imageURL, err := c.createDataset(ctx, directClient, token, teamID, filename, datasetUploadID, previewUploadID, cfg.Width, cfg.Height)
 	if err != nil {
 		return nil, nil, err
 	}
-	assetGroupID, _ := c.assetGroupID(ctx, client, token, teamID) // best-effort
+	assetGroupID, _ := c.assetGroupID(ctx, directClient, token, teamID) // best-effort
 
-	taskID, err := c.createTask(ctx, client, token, teamID, prompt, imageURL, assetID, assetGroupID, aspectRatio, seconds)
+	taskID, err := c.createTask(ctx, submitClient, token, teamID, prompt, imageURL, assetID, assetGroupID, aspectRatio, seconds)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	artifactURL, err := c.pollTask(ctx, client, token, teamID, taskID)
+	artifactURL, err := c.pollTask(ctx, directClient, token, teamID, taskID)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -109,7 +115,7 @@ func (c *Client) GenerateVideo(ctx context.Context, token, teamID, prompt, aspec
 	if !downloadResult {
 		return nil, meta, nil
 	}
-	data, err := c.download(ctx, client, artifactURL)
+	data, err := c.download(ctx, directClient, artifactURL)
 	if err != nil {
 		return nil, nil, err
 	}