Release the rebuilt Media Assistant behind a developer flag

[gateway]

What changed

• Rebuilt the Media Assistant around typed intent, durable Codex session continuity, server-owned graph/preset/recipe artifacts, explicit confirmation boundaries, and provenance-bound run review.
• Added reusable Media Preset and Prompt Recipe creation/refinement flows, graph planning, storyboard guidance, reference-image analysis, long-turn progress, and recipe/preset test lanes.
• Hardened graph execution identity, pricing freshness, run history provenance, recipe/preset quality evidence, and provider/session lifecycle behavior.
• Curated superseded development campaigns and paid QA fixtures out of the release tree while preserving the complete pre-curation state at archive/media-assistant-development-2026-08-18.
• Kept the Assistant developer-only: operational routes and the Graph Studio entry point fail closed unless NEXT_PUBLIC_MEDIA_STUDIO_ASSISTANT_DEBUG=1.
• Cleared all inherited file-size gates and deterministically regenerated the default-release OpenAPI schema without experimental Assistant routes.

Why

Months of local Media Assistant development had accumulated as a large unpublished branch with stale review material, generated-schema drift, and no backend release switch. This PR preserves the validated product work while removing release-only clutter and establishing a safe, reviewable route to main.

User and developer impact

Normal Studio, Graph, Media Preset, Prompt Recipe, provider configuration, pricing, and media workflows remain available. The Assistant stays opt-in for development and is not exposed to general users. No database migration, reset, saved-workflow deletion, provider-default change, or automatic paid generation is introduced by the release-curation slices.

Validation

• Full backend: 770 passed.
• Full web: 727 passed across 138 files.
• Web lint: 503 files.
• TypeScript check and production web build passed.
• Repository hygiene, storyboard genericity, style drift, file-size, JSON/OpenAPI, and diff checks passed.
• In-app browser verified disabled and enabled Assistant states, plus final Graph Studio/Assistant smoke.
• REL-003 through REL-006 each received independent Standards and Spec review; all final reviews were clean.
• Exact SQLite backup and archive tag were created before cleanup; the original dirty OpenAPI artifact is preserved locally by hash.

Merge safety

This is intentionally a draft while GitHub checks and final branch review complete. Merge without rewriting the archive tag or deleting local persistent data.