fix: enforce image masks and fail over short-input policy errors

[superman2003]

Summary

• Enforce PNG mask boundaries for OAuth multipart image edits by compositing generated pixels only where the mask permits them.
• Normalize edited image dimensions and output format, and correctly accept standard padded OpenAI base64 image payloads.
• Treat structured upstream HTTP 400 short_input_rejected responses as account failover signals across HTTP, SSE, and WebSocket paths while preserving ordinary client-facing 400 errors.

Testing

• go test ./internal/service -run OpenAI|Images -count=1
• go test ./internal/handler -count=1
• Focused mask, base64, and short-input tests with -count=3
• Focused HTTP, SSE, and WebSocket failover tests
• git diff --check

The full internal/service suite still has five unrelated Windows/environment failures: one asynchronous moderation refresh timeout and four plugin installer rename failures caused by temporary files remaining locked.

Fixes #6273