feat(image-generation): serve MiniMax image models through a dedicated media path

[octo-patch]

Reason: The image-generation registry recognised only two credential pools, so MiniMax image models could not be classified, routed, or served at all.

What changed

registry.ImageGenerationProvider is the single routing point the public images endpoints and the management console both read. It resolved to "" for image-01, so a request naming that model was rejected as "not a supported image generation model" before any credential was consulted.

• internal/registry/image_generation_models.go: classify image-01 and image-01-live, route them to the new ImageProviderMiniMax pool, and include them in ListImageGenerationModels. Pricing is left at zero because the published reference documents no per-image rate, and an invented number would surface as real spend in usage reporting.
• internal/registry/model_definitions_image_data.go / model_definitions.go: add the static catalog entries plus a minimax channel, so a model that routes to a pool is also reportable by that pool. Without this the models would be selectable and unreachable at the same time.
• internal/runtime/executor/minimax_media.go, minimax_media_request.go, minimax_executor.go: a media path for POST /v1/image_generation with bearer authorization. Chat is delegated unchanged to the existing compatibility executor, so only image traffic is new behaviour.
• internal/app/service/runtime_executor_registry.go: register the executor for minimax credentials.

Two upstream differences make a pass-through incorrect, and both are covered by tests:

• Requests. Dimensions arrive as a single size string but are sent as width/height, and byte output is requested as base64 rather than b64_json. Unsupported arguments are dropped from an allowlist that mirrors the SupportedParameters in the catalog, and the dropped names are logged so an operator can see which of their settings were ignored. An explicit aspect_ratio wins over derived pixels, matching the documented upstream precedence.
• Responses. Images are returned under data.image_urls or data.image_base64 rather than as a list of image objects, and failures arrive with HTTP 200 and a non-zero base_resp.status_code. Forwarded untranslated, an authentication or balance failure would reach the caller as a successful response carrying no images. Status codes are mapped so rate limiting surfaces as 429 and an exhausted balance as 402, which is what the shared quota-cooldown handling keys on.

Editing is deliberately not claimed: the reference-image form is a different upstream request shape, not a variant of this call, so SupportsImageEditing stays false and the edits alt is not intercepted. Configuration is untouched, so this does not overlap the open configuration PR.

Checks

• go build ./internal/registry/ ./internal/runtime/executor/ ./internal/app/service/
• go test ./internal/registry/ ./internal/runtime/executor/ -count=1
• go test ./sdk/api/handlers/openai/ ./sdk/cliproxy/ -count=1
• go test ./internal/api/handlers/management/ ./internal/app/service/ -count=1
• gofmt -l internal/registry internal/runtime/executor internal/app/service (clean)
• python3 scripts/check-backend-structure.py (passed)