Add a federated peer picker to Image Gen and Video Gen

[atomantic]

Summary

Adds the Generation target picker to Image Gen and Video Gen, so a render can be routed to a federated PortOS peer from the UI. Both generate routes have accepted mediaProviderPeerId / mediaProviderEngine since #4676 — this was the last non-ADR-gated acceptance-criteria bullet on #4348, and until now a user with a GPU peer had to reach for the API to use it for a picture or a clip.

• One shared RemoteMediaTargetPicker over a new useFederatedMediaTarget hook backs all three surfaces. The hook owns the peer list, the per-kind allowlist ∩ advertised-capabilities intersection, and the readiness verdict — Music Studio's private copy of that logic is deleted in favour of it, so a fourth surface cannot invent a fourth reading of the same peer.
• Only the intersection is offerable, because that is exactly what assertFederatedMediaProviderSelection admits. The two ways it can come up empty carry different remedies (nothing allowlisted here vs. the peer no longer advertising it) and are now said out loud instead of collapsing into one "unavailable".
• Wire v1 is text-to-image / text-to-video only. A form holding an init image, reference images, LoRAs, keyframes, a clip to extend, an audio track, chained chunks, or a non-text mode blocks Generate and names what has to go — rather than quietly dropping conditioning the user set up, which is the one thing the server refuses to do (MEDIA_PROVIDER_INPUT_UNSUPPORTED). Nothing is cleared for them, so switching the target back to This instance renders what they built.
• Readiness is re-derived at click time, not read off the last poll: a capacity window expires on the clock, so an enabled button can already be pointing at a lapsed peer. blockingReason() runs the server's gates in the server's order, and every branch fails closed — an unparseable freshUntil, a missing snapshot, or an absent queue.accepting all read as blocked, never as available.
• Picking a peer swaps the local model dropdown (and, on Image Gen, the quantization knob) for the peer's advertised models; resolution / steps / guidance / seed stay, since those do cross the wire.

No server changes, no wire changes, no new payload fields — an older peer behaves exactly as before, and omitting a peer leaves every local and cloud path byte-for-byte unchanged.

Test plan

• cd client && npm test — 739 files / 9403 tests green; npm run lint clean.
• New client/src/pages/ImageGen.federatedTarget.test.jsx and VideoGen.federatedTarget.test.jsx drive the real pages end to end: the submitted body carries the peer/engine/model triple and none of the local-dispatch fields (mode, quantize, cleaners, LoRAs, source frames, tiling, chunks…); a lapsed capacity window disables Generate and explains why; a non-text video mode blocks with the reason rather than submitting.
• New RemoteMediaTargetPicker.test.jsx covers the hook + picker together: allowlist ∩ capabilities (including the engine/model pair, not the id alone), the two distinct empty-list remedies, stale-window refusal in both the caption and the dropdown suffix, a switched-off peer holding a fresh snapshot, and verify() re-deriving after the clock moves past the window.
• federatedMediaReadiness.test.js gains unit coverage for federatedMediaModelsForPeer, including the shared empty-array identity callers memoize on.
• One existing MusicGenPanel fixture was made genuinely usable (it advertised no capabilities while asserting the "usable peer" branch) — the panel now explains that gap instead of printing a queue reading beside a disabled button.
• Local review pass: antigravity gemini-3.7-flash / effort medium against the branch diff — no material findings.

Remaining

Still open on #4348, all deliberately out of this slice:

• Remote lyrical conditioning (audio) and input-asset transfer (init/reference images, keyframes, LoRAs, chained renders). Both need ADR docs/decisions/2026-08-20-federated-visual-prompts.md revisited first — a human design call, not an implementation gap.
• Multi-provider fairness / failover. Automatic load balancing is listed Out of scope on the issue, and failover contradicts the fail-closed-never-fail-quiet decision recorded in feat([issue-4348]): route unattended renders to a configured federated peer #4679.
• A fixed-vocabulary visual profile for image/video prompts, explored during feat([issue-4348]): federate image/video job kinds (discovery + submission) #4674's review and deliberately not adopted.

Refs #4348