feat(ai): add Alibaba image generation

[opencode-agent]

Summary

• add Alibaba.configure(...).image(modelID) for direct international Qwen Image 2.0 and Wan 2.7 generation
• expose closed family-specific providerOptions.alibaba objects and protect protocol-owned HTTP body roots
• add portable GeneratedImage.expiresAt data while retaining Alibaba provider metadata
• automatically redact signed OSS-style credentials nested in recorded JSON response URLs
• document that Alibaba result URLs are temporary and must be persisted before expiry

Audit fixes

• make cassette redaction automatic and idempotent for OSS, AWS, and GCS signed query credential variants
• safely ignore finite Expires values outside JavaScript's Date range
• add type assertions for closed Qwen/Wan options and runtime coverage for reserved http.body.parameters
• fix the README Alibaba example so yield* runs inside Effect.gen
• re-record and structurally scan both live Alibaba cassettes, then verify replay

Validation

• bun ../../node_modules/prettier/bin/prettier.cjs --check ...
• bun typecheck
• bun run build
• bun test --timeout 30000 (360 passed, 29 fixture-gated skips)
• live RECORD=true Qwen Image 2.0 and Wan 2.7 cassette refresh
• focused cassette replay (3 passed)
• structural signed-query credential scan (both cassettes clean)

Scope

Direct Image.generate only. Legacy asynchronous Qwen/Wan models, image editing inputs, sequential image sets, and conversational tools remain intentionally excluded.

Requested by: @rekram1-node (Aiden Cline via Slack)