Get Image Host Config

Returns the current config. Token MASKED by default to keep it out of UI rendering paths (DOM dumps, screenshots, etc).

Pass ?reveal=1 to get the unmasked token — the bearer auth gates this to the owning user, and the response is over HTTPS, so it's no less secure than any other auth-protected resource. Used by omicos-core's figure_publisher and BenchView's manual upload path so they can talk to the image host (e.g. GitHub Contents API) DIRECTLY without ever routing image bytes through this server.

Also surfaces which active_provider values are eligible for this user — UIs gate the toggle on this list (e.g. 'cloud' only for paid plans; 'github' only when github config has repo+token).