Harden Flow generation and restore project lifecycle

[Bl0ck154]

Summary

This updates the current flow.google.com batchexecute path in four related areas:

• restore real Flow project creation through the current jHPbke RPC instead of requiring one permanently pinned FLOW_PROJECT_ID
• add a persistent 2-hour session-project lease for ad-hoc /api/flow/* calls that omit project_id, while keeping explicit project reuse available
• harden generation submission around PUBLIC_ERROR_UNUSUAL_ACTIVITY: do not auto-retry it, serialize CAPTCHA-bearing submits, enforce a minimum launch interval, and open a local cooldown circuit breaker when Google returns the block
• sync Omni request shapes with a live 2026-09-23 Flow UI capture: current full-frame crop [null, null, 1, 1], current text-to-video 360p model/option slots, and video client descriptor type 2

It also exposes generation guard/session-project state in /api/flow/status and logs an optional X-FlowKit-Caller label for generation endpoints without logging prompts, media IDs, or credentials.

Why

PUBLIC_ERROR_UNUSUAL_ACTIVITY is a Google risk/reCAPTCHA rejection, not merely a replayed token. Retrying it as a generic CAPTCHA failure can amplify the condition. During live validation, the same server/account/browser could submit successfully through the Flow UI while the older FlowKit first-frame payload was rejected. Capturing the accepted UI request showed the stale default crop; after matching the current UI shape, a direct FlowKit eb1hJf first-frame submit was accepted successfully.

The current Flow UI also still supports creating projects through the current jHPbke batchexecute RPC, so unrelated work no longer needs to accumulate in one permanently pinned project.

Compatibility

• explicit project_id / flow_project_id reuse still works
• legacy low-level FLOW_PROJECT_ID fallback remains for older internal callers
• polling/media/project metadata RPCs bypass the new generation throttle
• only image/video CAPTCHA-bearing generation submits are guarded
• text-video callers that already encode _360p in the model key continue to work; resolution can also be supplied explicitly

Tests

373 passed on this upstream-based branch after the live-capture payload update.