feat: finalize generation provider workflows

[appergb]

Summary

• connect image, video, audio, and 2x upscale tools to the shared production Tauri generation bridge
• persist durable placeholders, lifecycle logs, progress, cancellation, retry, partial terminal states, and restart recovery
• stream terminal media into the same journaled whole-bundle publication as media.json and generation-log.json, with exact byte-size validation and byte-exact rollback on failure
• add capability-gated discovery, explicit cost authorization, secure result download, and MediaPanel controls
• reconcile the Task 2 planning records and retain deterministic runtime evidence

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace --no-fail-fast -q
• pnpm build
• pnpm test (703 passed)
• generation::tests (9/9) and focused provider/persistence/FFmpeg tests

Notes

• deterministic configured-provider fixtures cover image/video/audio/upscale without paid network calls
• real paid-account smoke remains part of Beta release validation
• current built-in audio catalog has no video-input model, so that path fails closed by capability