[Inference/Web] Expose validated generation controls in the web/API decompile flow

[agorevski]

Finding

The web/API decompile path does not let users select generation settings such as max output tokens, sampling, temperature, or repetition penalty, and it does not return the effective settings used.

Evidence

• The web form exposes compiler metadata only: web/templates/index.html:55-83.
• /api/decompile documents only bytecode and compiler metadata fields: web/app.py:531-534.
• Server calls decompile_batch() and decompile_tac_to_solidity() without passing request-level generation args, so defaults apply silently: web/app.py:780-782, web/app.py:832-835.
• The model API has tunable defaults (max_new_tokens=1024, temperature=0.1, do_sample=False, repetition_penalty=1.15): src/model_setup.py:1274-1282, src/model_setup.py:1316-1322.
• Web model artifact selection is startup-only via env/CLI: web/app.py:1081-1088.

Impact

Model developers cannot tune latency/quality, cap expensive generations, or compare model artifacts from the standard web/API path. Users also cannot tell whether a result used defaults or custom settings.

Recommended fix

Add a validated generation object to /api/decompile and an "Advanced settings" UI section. Return effective_generation_config and model artifact identity in the final result.

Acceptance criteria

• API accepts bounded max_new_tokens, temperature, do_sample, and repetition_penalty with clear 400 errors for invalid values.
• UI exposes safe advanced controls with defaults and reset-to-default.
• Response includes the effective generation config and model path/name used.
• Tests cover valid/invalid generation options and confirm they are passed to the decompiler.

[agorevski]

Resolved in commit e4a1530. Validation: python -m compileall -q train.py download_hf_contracts.py src web scripts tests; uv run pytest -q (521 passed).