Plugin sessions — multi-product orders, voting, and clone

The Plugin Integration API now models photo shoots as sessions — one shared configuration, many products in a single order — and adds post-generation accept/reject plus a session clone endpoint.

POST /api/v1/plugin/jobs and POST /api/v1/plugin/jobs/batch now accept a session instead of a single job: one session_config (model, scenery, preset, aspect ratio, suggestions) plus a list of subjects[], where each subject defines a product (packshot_asset_id, product_label, product_ref, images_count, ai_model). The server creates one order and expands every subject into the requested number of generation jobs, all sharing the session configuration. The response returns the new order_id together with the per-subject job ids.

The job DTO now carries its subject context (packshot_asset_id, product_label, product_ref) and the new post-generation voting fields (voting, voting_at). Three new endpoints round out the lifecycle: POST /jobs/{id}/accept and POST /jobs/{id}/reject record a user vote on a finished job; GET /orders/{id} returns the full session envelope (session config, per-subject statistics, signed outputs, credit summary); POST /orders/{id}/clone re-issues a session with the same configuration and subject list (with an optional override of images_count per product_ref). Webhook payloads also gain the new subject and voting fields on job.*.

This is a breaking change to POST /jobs and POST /jobs/batch — the legacy single-job and {jobs: [...]} shapes no longer parse. The migration note in the endpoints reference covers the move.