feat(zerogpu): add Breeze TTS 2 experimental voice + remove image gen by policy

feat(security): opt-in Gradio UI password lock via GRADIO_UI_PASSWORD

fix(auth): local callers resolve FLOW_API_KEY ahead of HF_TOKEN

fix(security): enforce bearer auth on all GPU-burning REST endpoints