Add REST API for preset-based generation and fallback cover images

REST API (routes/api.py): Three endpoints behind API key auth for
programmatic image generation via presets — list presets, queue
generation with optional overrides, and poll job status.

Shared generation logic extracted from routes/presets.py into
services/generation.py so both web UI and API use the same code path.

Fallback covers: library index pages now show a random generated image
at reduced opacity when no cover is assigned, instead of "No Image".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

routes/settings.py

@@ -1,9 +1,12 @@
 import json
 import logging
+import os
+import random
+import secrets
 import subprocess
 
 import requests
-from flask import flash, redirect, render_template, request, session, url_for
+from flask import flash, jsonify, redirect, render_template, request, session, url_for
 
 from models import Checkpoint, Settings, db
 
@@ -12,6 +15,19 @@ logger = logging.getLogger('gaze')
 
 def register_routes(app):
 
+    @app.template_global()
+    def random_gen_image(category, slug):
+        """Return a random generated image path for a resource, or None."""
+        folder = os.path.join(app.config['UPLOAD_FOLDER'], category, slug)
+        try:
+            images = [f for f in os.listdir(folder)
+                      if f.lower().endswith(('.png', '.jpg', '.jpeg', '.webp'))]
+        except FileNotFoundError:
+            return None
+        if not images:
+            return None
+        return f"{category}/{slug}/{random.choice(images)}"
+
     @app.context_processor
     def inject_comfyui_ws_url():
         url = app.config.get('COMFYUI_URL', 'http://127.0.0.1:8188')
@@ -227,3 +243,14 @@ def register_routes(app):
             return redirect(url_for('settings'))
 
         return render_template('settings.html', settings=settings)
+
+    @app.route('/api/key/regenerate', methods=['POST'])
+    def regenerate_api_key():
+        settings = Settings.query.first()
+        if not settings:
+            settings = Settings()
+            db.session.add(settings)
+        settings.api_key = secrets.token_hex(32)
+        db.session.commit()
+        logger.info("API key regenerated")
+        return jsonify({'api_key': settings.api_key})