fix: image gen response parsing, camera DISABLE_CAMERA, lazy MediaPipe init

fix: enable MOCAP and SANDBOX features - remove maintenance gates, fix camera toggle, fix unclosed video tag

Fix login/signup: use db.session.get(), fix CSRF ordering, fix password validation, handle non-JSON errors

Initial Nexus AI release