Add provider-aware image generation and Custom endpoints

[Paul Lizer (paullizer)]

Summary

• Qualify image generation by the configured provider, API, model, and endpoint cloud. Azure/Foundry image choices use dedicated models; hosting SimpleChat in Azure Government does not disable approved commercial endpoints.
• Forward-port Custom connections into React v2 and reuse their guarded transport, authentication, and scoped credentials for direct OpenAI Images and Responses operations.
• Add documented MAI Image and Foundry FLUX adapters alongside GPT Image, including provider-specific payloads, rendering options, and availability/lifecycle metadata.
• Make the editor distinguish masked edits, whole-image reference edits, and regeneration; preserve independent defaults, migration backups, revision history, and actionable failures.

Target branch: paullizer-react-v2-ui. This PR contains the image-provider change on top of React v2, not a merge of Development.

Policy clarification: Microsoft documents conditional Azure Responses image generation backed by a separate GPT Image deployment. This PR deliberately applies the agreed standalone-only Azure/Foundry image policy; it does not claim that the Azure tool never exists. Direct OpenAI tool generation remains available through qualified Custom connections.

Linked issue

No new issue was requested for this change. Related foundations: Refs #1436; selectively forward-ports the Custom endpoint work from #1437.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

No Latest Feature card is included. Release notes were left unchanged because the owner was unavailable to approve that optional update.

Existing Azure GPT image defaults become unavailable with a replacement notice; administrators should select a supported dedicated image model. No model or provider is substituted automatically.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.106 → 0.261.107. No deployer files changed.

Testing / validation

• Targeted Custom/capability/default/migration/runtime/SDK/admin functional batch: 269 passed, using the repository-pinned OpenAI 1.109.1 SDK.
• python -m pytest -q functional_tests\test_image_chat_route_integration.py functional_tests\test_v2_image_editor.py: 22 passed.
• python -m pytest -q ui_tests\test_admin_custom_connections.py ui_tests\test_admin_shared_ai_connections.py ui_tests\test_admin_shared_ai_connections_classic.py ui_tests\test_image_editor_capabilities.py: 58 passed.
• npm --prefix application\v2_ui run build; Custom/shared frontend logic suites and 16 image capability checks passed.
• Existing Blueprint/access-policy, documentation inventory/site-quality, vision capability, and JavaScript syntax checks passed.
• Review findings concerning known-negative capability overrides and Classic gateway-key prefix preservation were fixed and covered by regressions.

HTTP/provider dependencies are mocked for these checks. No live provider certification, paid inference, or Azure resource provisioning was performed.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated AI Models administration, connection/image guides, chat controls, shared-connection/image feature documentation, and the provider-capability fix notes. Added Custom connection and model-catalog documentation. Regenerated the application-surface inventory.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

Custom image requests retain the shared DNS-pinned transport and URL/authentication rules. Derived image URLs use a fresh guarded client without forwarding inference credentials, identity headers, cookies, or mTLS credentials.