Add a two-level toggle to disable AI image generation, plus aspect-ratio control

Problem/Motivation

AI image generation (the _generate syntax on media reference fields) ran whenever the AI requested it, with no way to turn it off. A site could not disable it short of removing the field handler, and an individual editor could not opt out, so every request spent a text_to_image (Imagen) provider call even when the user only wanted layout or text changes.

Generated images also had no shape control: every image used the provider's default aspect ratio regardless of whether it was a full-width hero or a square thumbnail. Finally, the generation write path created media and wrote fields without checking the browsing user's access.

Proposed resolution

• Add ImageGenerationGate, which ANDs a site-wide master switch (ai_plus.settings.image_generation_enabled, default on) with a per-user preference (navigation_plus EditorSettings, key ai_plus.generate_images, default on). Generation runs only when both are on.
• When generation is off, the field handler keeps the placeholder (on create) or the existing value (on update) as the final image and emits no DeferredOperation. It returns a BlueprintWarning so the AI tells the user generation was off and how to re-enable it. Remediation differs by level: a site-wide switch needs an administrator, a per-user toggle the editor can flip themselves.
• The _generate syntax gains an optional aspect_ratio (1:1 / 4:3 / 16:9), validated by the handler and honoured by the processor, including across the prompt-rewrite retry.
• Gate the write path on the current user: media create access before spending an Imagen call (non-retryable on denial), and field-editable access before each layout-surgery write.

User interface changes

• New Enable AI image generation checkbox on the Navigation Plus settings form (the site-wide master switch).
• New per-user Generate images toggle in the AI tool's Edit Mode settings panel, shown only when generation is enabled site-wide and persisted live via the navigation_plus editor-preference helper.
• The "generating" shimmer now highlights the specific field being generated rather than the whole block.

API changes

• New service ai_plus.image_generation_gate (ImageGenerationGate).
• The _generate field-handler guidance now documents the optional aspect_ratio and how to choose it.
• Relies on entity_blueprint's BlueprintWarning (returned when generation is off) and BlueprintAccessChecker (write-path access checks), and navigation_plus EditorSettings (per-user preference).

Data model changes

• New config key ai_plus.settings.image_generation_enabled (boolean, default true), with matching config schema.