Disable image generation for Free-plan accounts (#34850)

## What changed

Skip registering the standalone `image_generation` tool when cached
authentication identifies the account plan as Free. Leave the existing
feature, provider capability, model modality, and authorization checks intact
for other account plans.

GitOrigin-RevId: 54d3b73dc610e508db7e281c4d7a8e72961e35a6

codex-rs/core/src/tools/spec_plan.rs

@@ -60,6 +60,7 @@ use crate::tools::router::ToolRouter;
 use crate::tools::router::ToolRouterParams;
 use codex_features::Feature;
 use codex_login::AuthManager;
+use codex_protocol::account::PlanType;
 use codex_protocol::config_types::WebSearchMode;
 use codex_protocol::dynamic_tools::DynamicToolNamespaceTool;
 use codex_protocol::dynamic_tools::DynamicToolSpec;
@@ -366,6 +367,16 @@ fn image_generation_available(turn_context: &TurnContext) -> bool {
         return false;
     }
 
+    if turn_context
+        .auth_manager
+        .as_deref()
+        .and_then(AuthManager::auth_cached)
+        .and_then(|auth| auth.account_plan_type())
+        == Some(PlanType::Free)
+    {
+        return false;
+    }
+
     let capabilities = turn_context.provider.capabilities();
     if !capabilities.image_generation || !capabilities.namespace_tools {
         return false;