fix(api): IP-adapter mask accumulation, null params, colon-in-password, raw allowed path

generate.py: p.ip_adapter_masks was reinitialized inside the per-adapter loop, discarding all but the last adapter's masks; move it beside the other accumulators. process.py: req.params is dict|None, so a null params body crashed .items() in post_preprocess/post_mask. api.py: split(':') without maxsplit broke auth/auth-file entries whose password contains a colon. gallery.py: allowed_paths stored quote(path) but the membership check and path guards use the raw path, causing duplicate accumulation and an ineffective whitelist; also drop the unused FastAPI import (pylint W0611 surfaced when this file is linted).

Co-Authored-By: Claude <noreply@anthropic.com>

modules/api/process.py

@@ -76,7 +76,7 @@ class APIProcess:
         if processor is None or processor.processor_id != req.model:
             with self.queue_lock:
                 processor = processors.Processor(req.model)
-        for k, v in req.params.items():
+        for k, v in (req.params or {}).items():
             if k not in processors.config[processor.processor_id]['params']:
                 return JSONResponse(status_code=400, content={"error": f"Processor invalid parameter: id={req.model} {k}={v}"})
         jobid = shared.state.begin('API-PRE', api=True)
@@ -102,7 +102,7 @@ class APIProcess:
             return JSONResponse(status_code=400, content={"error": f"Mask type not found: id={req.type}"})
         image = decode_base64_to_image(req.image)
         mask = decode_base64_to_image(req.mask) if req.mask else None
-        for k, v in req.params.items():
+        for k, v in (req.params or {}).items():
             if not hasattr(masking.opts, k):
                 return JSONResponse(status_code=400, content={"error": f"Mask invalid parameter: {k}={v}"})
             else: