feat(image-storage): 异步生图对象存储改为后台配置，保存即生效

此前开启异步生图必须改服务器上的 config.yaml 并重启容器（#4542），且若想
复用已配置的备份 S3，还得把同一套凭证再填一遍（#4458）。

- 新增 ImageStorageSettingService：配置存 settings 表，SecretAccessKey 经
  SecretEncryptor 加密落库、读回脱敏、留空表示沿用旧值，与备份 S3 配置同一套做法。
- reuse_backup_s3（默认开）直接借用 backup_s3_config 的端点与密钥，只用自己的
  bucket/prefix 区分对象，因此备份走 backups/、图片走 images/，且密钥不会在库里存两份。
- ImageTaskService 的启用状态改由 ImageStorageResolver 在运行时解析并缓存，
  保存设置后 Invalidate 使下次请求重建客户端——不再需要重启。
- repository 侧由提供实例改为提供工厂，客户端才可能在运行期重建。
- 轮询接口的门控从 enabled() 放宽为 Pollable()：关掉开关只拒绝新提交，
  已受理的任务仍可取回结果，不再被中途吞掉。
- config.yaml 的 image_storage 保留为回落，后台从未保存过时沿用，
  升级前已用配置文件开启的部署不受影响。
- 管理端 GET/PUT/POST /admin/backups/image-storage，PUT 与备份 S3 配置一样要求
  step-up 2FA：改写存储目标同样能把生成内容导向外部账号。

注：go generate ./cmd/server 在当前 upstream 基线上即失败（securityaudit.
PromptAdminService 缺 provider），故 wire_gen.go 为手工同步。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VHreE5pzCkSYz7J45fmd2Y

docs/ASYNC_IMAGE_TASKS.md

@@ -20,6 +20,20 @@ Only OpenAI and Grok groups are supported. Requests use the same JSON or multipa
 
 Asynchronous image tasks are **disabled by default** and gated on object storage. When the switch is off — or the S3 credentials are incomplete — the async endpoints return `404` and never create a task or write to Redis. This is deliberate: without offloading, large `b64_json` results (several MB each, e.g. `gpt-image-1`) would accumulate in Redis and exhaust its memory.
 
+### From the admin UI (recommended)
+
+**Admin → Backup → Async image object storage.** Saving the form takes effect immediately — the object-storage client is rebuilt on the next request, so there is no container restart.
+
+Because the async image storage and the database backup share one S3 client, the form defaults to **reusing the backup S3 configuration**: it borrows the endpoint, region and credentials already configured above and keeps only its own bucket and prefix, so backups stay under `backups/` while images go to `images/`. Leave the bucket empty to use the backup bucket as well. Untick the box to point images at a completely separate account.
+
+Saving requires step-up 2FA when that gate is enabled, for the same reason the backup S3 form does: changing the target redirects generated content to another account.
+
+Turning the switch off stops new submissions but keeps already-accepted tasks pollable, so nothing in flight is stranded.
+
+### From the config file
+
+The admin setting takes precedence. When nothing has ever been saved there, the `image_storage` block in `config.yaml` is used instead, so deployments that enabled the feature before the admin UI existed keep working untouched.
+
 Configure an S3-compatible object store (AWS S3, Cloudflare R2, Aliyun OSS, MinIO, …) in `config.yaml` (all keys also accept the `IMAGE_STORAGE_*` environment overrides):
 
 ```yaml