fix: only admins may switch the global Automatic1111 checkpoint from image generation (#27244)

The Automatic1111 branch of the image generation route called set_image_model whenever the request carried a model field. On this backend set_image_model is not request-scoped: it persists image_generation.model to the global configuration and posts the new sd_model_checkpoint to the shared server, because Automatic1111 holds a single checkpoint instance-wide. A non-admin holding features.image_generation could therefore change the instance-wide image model and the shared backend checkpoint for every user by sending a model on an ordinary generation request, even though the setting is otherwise managed only through the admin-only image configuration route and the frontend never sends this field.

Gate the switch on an admin caller. A non-admin now generates on the currently configured checkpoint and the model field no longer mutates global state; admins retain per-request model switching here and through the image configuration route. Image editing is unaffected, as it selects its model per request without writing global configuration.

backend/open_webui/routers/images.py

@@ -785,7 +785,11 @@ async def image_generations(
                 images.append({'url': url})
             return images
         elif image_config.IMAGE_GENERATION_ENGINE == 'automatic1111' or image_config.IMAGE_GENERATION_ENGINE == '':
-            if form_data.model:
+            # Automatic1111 holds one checkpoint instance-wide, so set_image_model
+            # persists the global default and switches the shared backend. Only an
+            # admin may do that; a non-admin generates on the currently configured
+            # checkpoint. The model field is not a per-user selection on this backend.
+            if form_data.model and user.role == 'admin':
                 await set_image_model(request, form_data.model)
 
             data = {