Support Pollinations tokens from URL parameters

[hackall360]

Summary

• allow the client to resolve Pollinations tokens from URL parameters before trying remote sources
• scrub the captured token from the location so it is not left in the visible address
• document the static-host override and cover the workflow with a regression test

Testing

• npm test
• npm run build

---

https://chatgpt.com/codex/tasks/task_b_68ca9e6e9ccc832fa47f130dab91fae8