fix(api): IP-adapter mask accumulation, null params, colon-in-password, raw allowed path

generate.py: p.ip_adapter_masks was reinitialized inside the per-adapter loop, discarding all but the last adapter's masks; move it beside the other accumulators. process.py: req.params is dict|None, so a null params body crashed .items() in post_preprocess/post_mask. api.py: split(':') without maxsplit broke auth/auth-file entries whose password contains a colon. gallery.py: allowed_paths stored quote(path) but the membership check and path guards use the raw path, causing duplicate accumulation and an ineffective whitelist; also drop the unused FastAPI import (pylint W0611 surfaced when this file is linted).

Co-Authored-By: Claude <noreply@anthropic.com>

modules/api/generate.py

@@ -70,6 +70,7 @@ class APIGenerate:
             p.ip_adapter_starts = []
             p.ip_adapter_ends = []
             p.ip_adapter_images = []
+            p.ip_adapter_masks = []
             for ipadapter in request.ip_adapter:
                 if not ipadapter.images or len(ipadapter.images) == 0:
                     continue
@@ -79,7 +80,6 @@ class APIGenerate:
                 p.ip_adapter_starts.append(ipadapter.start)
                 p.ip_adapter_ends.append(ipadapter.end)
                 p.ip_adapter_images.append([helpers.decode_base64_to_image(x) for x in ipadapter.images])
-                p.ip_adapter_masks = []
                 if ipadapter.masks:
                     p.ip_adapter_masks.append([helpers.decode_base64_to_image(x) for x in ipadapter.masks])
             del request.ip_adapter