feat: add model_policy=permissive for open-weight model routing

[realityinspector]

Summary

• Adds model_policy field to GenerateRequest — when set to "permissive", auto-selects only open-weight/distillable models (DeepSeek, Llama, Qwen, Mistral)
• New shared module app/core/model_policy.py with model licensing classification and registry-aware selection
• Text routes through OpenRouter to best available permissive model (Llama Scout → Maverick → DeepSeek → Qwen → Mistral)
• Images route directly to Pollinations (free, open-source) instead of Google Imagen
• Pipeline now dynamically derives model_permissiveness from actual model used instead of hardcoded "restricted"
• Explicit text_model/image_model in request always take precedence over policy

Motivation

Clockchain expander requires all generated content to use only permissive/distillable models. Previously Flash defaulted to Gemini, violating this policy.

Files Changed

File	Changes
app/core/model_policy.py	NEW — shared policy logic, permissive prefix list, registry-aware model selection
app/api/v1/timepoints.py	Added model_policy field, resolve logic in sync/async/stream endpoints
app/core/pipeline.py	Dynamic model_permissiveness derivation
app/core/llm_router.py	Pollinations direct path for image generation

Test plan

• Verify ruff passes on all changed files
• Test sync generation with model_policy: "permissive" — should use Llama/DeepSeek for text, Pollinations for images
• Test without model_policy — should use default models (Gemini)
• Test with explicit text_model + model_policy — explicit model should win
• Verify TDF payload has correct model_permissiveness value