Chore/flow drop legacy rest

[crisng95]

What

Removes the aisandbox-pa.googleapis.com REST transport, which has had no
reachable caller since Flow moved to flow.google.com in September 2026 and
stopped minting the Bearer ya29.… it needed. Net −1043 lines.

Keeping a dead implementation beside a live one turned out to cost more than it
saved: the Omni module was written against the REST path, so when the migration
landed on FlowClient it missed Omni entirely, and Omni frame/reference
generation has been returning UNSUPPORTED_ON_BATCH_API ever since. Deleting
the template is what stops the next copy.

Removed: the ten _legacy_* methods, the twelve if not USE_BATCH_RPC branches
in FlowClient, _build_url/_client_context, ENDPOINTS, GOOGLE_FLOW_API,
GOOGLE_API_KEY, the browser-fingerprint pools and agent/services/headers.py
that fed them, the tRPC polling branch in omni_flash, and _annotate_polling,
whose only callers were the REST submits. RECAPTCHA_SITE_KEY went too — no
Python caller, and the extension hardcodes its own copy in injected.js.

The extension keeps its api_request/trpc_request proxies for now. No current
agent sends them, but an older agent in the wild might; retiring them is a
manifest.json bump and a user-visible reload, so it is its own change.

Commits

Commit	Why
d56a5cc	Remove the REST transport
d009dc2	Repair two test mocks that drifted behind refactors
f4e2265	Teach /fk-doctor the NO_INJECTION_RESULT error
0c45b39	Bump extension to 0.3.2, note the working Flow API in the README

Verified against the live Flow API

Not just unit tests — the whole path was exercised end to end through a
signed-in Flow tab, since that is the only thing that can sign these calls:

Call	Result
generate-image	200 — media_id 2ad427aa-…, proper UUID
export-image 2K	200 — 3.3 MB JPEG, 1536×2752 from a 768×1376 source
generate-video (i2v, veo)	200 — op cf6f80cd-…
downloaded clip	8.0 s, 720×1280, h264 + AAC, 192 frames
get_media, credits	200 — both replace deleted _legacy_* methods
start+end chaining	502 UNSUPPORTED_ON_BATCH_API — fails loudly, as intended
agent log	zero errors

Every response arrived over POST /api/ext/callback with match=yes, i.e. the
primary delivery path, not the WS fallback.

Worth a reviewer's attention

One defect came from the rebase, not from either parent. This branch deleted
the USE_BATCH_RPC definition while the migrated image API (#42) added a new
if not USE_BATCH_RPC: guard inside upscale_image. Different files, so git
merged both cleanly and upscale_image raised NameError on every call. It is
removed here the same way as the other eleven guards, and the 2K export above is
that code path running for real.

The four unported capabilities are listed from the guards, not the docs,
because the docs disagree. flow_client.py blocks start+end chaining, r2v and
video upscale; omni_flash.py:33 blocks Omni frame/reference. CLAUDE.md
calls the third "4K upscale", which reads as the image export — and that one
works (see the 2K result above). docs/CAPTURE.md also still lists an item the
image API merge has since ported. Flagging rather than fixing: correcting those
two docs is not this PR's job.

Tests

266 passed, and the suite now exits.

Two mocks had drifted behind refactors and were failing for reasons unrelated to
this change:

• test_processor.py patched processor._retry_state, a module global replaced
  by self._retry_after plus a retry_after parameter. mock.patch rejects a
  missing attribute, so three tests raised AttributeError before their bodies ran.
• test_result_handler.py mocked crud.update_scene but not crud.get_scene,
  which c071cb8 added for the chain cascade in April. Those three tests had been
  hitting a real schema-less database ever since.

That second one also explains why pytest tests/unit never exited: aiosqlite
services each connection on a non-daemon thread, and the connection opened by
accident was never closed, so it outlived the session. Piping the run hid it —
the summary sat in the pipe buffer while the process refused to die.

Not in this PR

• extension/manifest.json's aisandbox-pa host entry, and the two legacy
  proxies in background.js — they share one lifetime and need a reload.
• Correcting CLAUDE.md's "4K upscale" wording and docs/CAPTURE.md's stale entry.
• The 13 drawtext test failures on a stock Homebrew ffmpeg: that build ships
  without --enable-libfreetype, so text-overlay skills need ffmpeg-full on
  PATH. Environmental, pre-existing, unrelated.

Reviewer notes

• Reload the extension once after merging — /health should then report 0.3.2.
  Before this PR it reported 0.3.1 for both the pre- and post-Expand migrated image API: model selection, edits and 2K export #42 build, so a
  stale extension was indistinguishable from a current one.
• flow_key_present: false in /api/flow/status is normal on this transport;
  there is no bearer to capture.
• A status poll answering "Media not found." is not a failure — finished
  jobs report it. Confirm via the media record instead.

🤖 Generated with Claude Code