/v1/characters/generate and /v1/environments/generate produced their reference
images by calling execute_internal_request(request.app, '/v1/images/generations')
— an IN-PROCESS self-dispatch on whatever engine handled the request. Two bugs:

1. It re-entered the engine's own _InternalAuthMiddleware without the internal
   token, so in multi-engine mode it 403'd ('engines are reachable only through
   the front proxy') — image gen failed while plain text worked (text never
   self-dispatches). Township (a normal API client) hit exactly this.
2. Even with a token it would run the image model on the WRONG engine: the image
   model may be assigned to / pinned on a different engine than the one serving
   the characters/environments request.

Add execute_api_request(): behind a front (CODERAI_INTERNAL_TOKEN set) it routes
the sub-request THROUGH THE FRONT (the single public API) at 127.0.0.1:<front
port>, so the front picks the engine that owns the image model and stamps the
internal token itself; the caller's Authorization is forwarded so that engine
authorises it like any client call. Single-process mode still dispatches
in-process (middleware is a no-op with no token). The client never sends internal
headers — it just talks to the one API endpoint.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RdMufYvtTbtGDWsiZVoXce