feat: multi-pass AI research with draft approval and hero image generation

[fatherlinux]

Summary

• Replace single-pass Gemini research with two-pass workflow: Pass 1 (metadata + brief description) and Pass 2 (historical description) with URL-first grounding and Google Search
• Add admin research context textarea for guiding AI research
• Draft approval modal with per-field accept/reject toggles and editable values
• Auto-generate 1800s-style hero images via Gemini image model concurrently after research completes
• Robust JSON parser that handles truncated Gemini responses (token limit mid-array)
• New research_context database column with migration
• Three new API endpoints: /ai/research-v2, /ai/generate-hero-image, /ai/accept-hero-image

Closes #102
Closes #99

Test plan

• Navigate to a sparse POI, enter research context, click "Research with AI"
• Verify draft modal appears with Pass 1 + Pass 2 results and hero image auto-generating
• Verify Accept button disabled until image generation completes
• Accept fields, verify they populate in edit form
• Test Regenerate and Remove on hero image
• Verify Save Changes button disabled during research
• Test prompt editor pencil icons on Brief/Historical Description labels
• 222/224 tests pass (2 pre-existing flaky failures)

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces a multi-pass AI research system and hero image generation using Gemini. Key additions include a new research-v2 endpoint with draft approval, image generation capabilities, and a jitter utility for scheduled jobs to prevent bot detection. Feedback focuses on improving the robustness of file extension handling for generated images, refactoring duplicated API key retrieval logic, and enhancing security by moving API keys from URL parameters to request headers while adding necessary fetch timeouts.

[gemini-code-assist]

The logic for determining the file extension based on the MIME type is incomplete. Gemini models can return images in image/webp format, which would currently default to a .png extension. This can lead to file type mismatches in storage or when serving the asset.

Suggested change

	const imageBuffer = Buffer.from(imageData, 'base64');
	const extension = mimeType === 'image/jpeg' ? 'jpg' : (mimeType === 'image/webp' ? 'webp' : 'png');

[gemini-code-assist]

The logic for retrieving the Gemini API key from environment variables or the database is duplicated here. It is already implemented in the createGeminiClient function. Consider refactoring this into a shared helper function to improve maintainability and ensure consistency across the service.

[gemini-code-assist]

Passing the API key as a query parameter in the URL is less secure than using a request header, as URLs are frequently logged by proxies and servers. Additionally, the fetch call lacks a timeout, which could cause the request to hang indefinitely if the API is unresponsive.

  const url = `https://generativelanguage.googleapis.com/v1beta/models/${modelName}:generateContent`;

  const controller = new AbortController();
  const timeoutId = setTimeout(() => controller.abort(), 60000); // 60s timeout

  const response = await fetch(url, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-goog-api-key': apiKey
    },
    signal: controller.signal,