feat: harden deployment and public api handoff

lib/server/generation-service.ts

@@ -215,7 +215,8 @@ export async function syncImageJob(jobId: string, origin: string): Promise<Gener
       source: sourceForCapability(job.capability),
       capability: job.capability,
       jobId: job.id,
-      index
+      index,
+      tags: assetTagsForJob(job)
     }));
   }
   if (assets.length) {
@@ -300,7 +301,8 @@ async function syncEvolinkImageJob(job: GenerationJob, origin: string): Promise<
       source: sourceForCapability(job.capability),
       capability: job.capability,
       jobId: job.id,
-      index
+      index,
+      tags: assetTagsForJob(job)
     }));
   }
   await recordUsageEvent({
@@ -346,6 +348,7 @@ async function completeMockJob(job: GenerationJob, origin: string): Promise<Gene
     source: sourceForCapability(job.capability),
     capability: job.capability,
     jobId: job.id,
+    tags: assetTagsForJob(job),
     metadata: {
       mock: true
     }
@@ -376,6 +379,10 @@ function sourceForCapability(capability: string) {
   return "generated";
 }
 
+function assetTagsForJob(job: GenerationJob): string[] {
+  return job.externalClientId ? [job.capability, `api-client:${job.externalClientId}`] : [job.capability];
+}
+
 function asRecord(value: unknown): Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value)
     ? value as Record<string, unknown>