Import a generation from a ZIP archive.

Auth-walled (B1): the route was fully unauthenticated and the underlying importer reached across tenants (unscoped profile lookup + "use any profile" fallback that leaked a victim's profile name, and an ownerless generation row written to shared disk). It now requires an identified user — get_current_user is a no-op returning None when SaaS is off (desktop byte-identical) and 401s an anonymous SaaS caller — and threads that user_id into the importer so the row is stamped and the profile lookup is scoped to the caller.