feat(picture,api): GPT-Image-2 image generation

Adds a third provider path to /api/v1/picture/generate that calls OpenAI
gpt-image-2 when model starts with "openai/". Supports n=1..4 batch
generation with character continuity, base64 response decoded server-side
and uploaded to mana-media for dedup + thumbnails. Credit cost scales
by quality (low=3, medium=10, high=25) × n.

Env plumbing:
- scripts/generate-env.mjs: new apps/api/.env stanza propagates
  OPENAI_API_KEY + REPLICATE_API_TOKEN from .env.secrets
- .env.macmini.example: documents OPENAI_API_KEY for prod

Frontend /picture/generate: model + quality + aspect-ratio + batch-count
selectors, real fetch with auth, persists each image via imagesStore.insert
(encrypted + synced). Wrapped in ModuleShell variant=fill with back-arrow
to /picture and a live credit badge in the header actions slot.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.macmini.example

@@ -76,6 +76,13 @@ SUPABASE_SERVICE_ROLE_KEY=
 AZURE_OPENAI_ENDPOINT=https://your-resource.openai.azure.com/
 AZURE_OPENAI_API_KEY=your-api-key-here
 
+# ============================================
+# OpenAI (direct, non-Azure)
+# ============================================
+# Consumed by mana-research (deep research) and mana-api picture module
+# for gpt-image-2 image generation. Distinct from AZURE_OPENAI_* above.
+OPENAI_API_KEY=
+
 # ============================================
 # Monitoring (Grafana)
 # ============================================