Fix LoRA cross-request leak: serialize _ensure_lora + generate with a lock

Klein sidecar: per-request LoRA registry + optional pose-reference image (FLUX.2 native image conditioning); env-overridable model/steps/guidance for local box runs

Upload app.py with huggingface_hub

Add Klein ZeroGPU sidecar