fix: downloads stop leaving files on disk that the library doesn't use

- An archive whose images were extracted was kept at its download path
  as well as in the attachments store. Both download paths now remove
  the downloaded copy.
- A downloaded file the import filters reject (too small, transparent,
  single colour, unreadable) was left on disk with no record. A later
  walk found it, imported it again and rejected it again, every time.
  Rejected files are now removed; the seen ledger keeps them from being
  downloaded again.
- Both paths share one policy, Importer.discard_after_attach, which
  never removes a file an ImageRecord points at.
- An external-link fetch that fails, or whose worker was killed, left
  partial files (megatools' .megatmp.*) in the link's dir, and a killed
  fetch left its link 'downloading' for good. A fetch now clears
  unrecorded leftovers before starting and after failing. The sweep
  returns a link to retry once it has been 'downloading' past the
  task's hard limit, using a new external_link.started_at column
  (migration 0117).
- The orphaned temp-file sweep now recognises .megatmp.* as well as
  .part and .partial.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_maintenance.py

@@ -41,9 +41,13 @@ def test_cleanup_orphaned_temp_files_removes_stale_only(tmp_path, monkeypatch):
     fresh.write_bytes(b"x")
     keep = tmp_path / "real.jpg"                        # a real image → keep
     keep.write_bytes(b"x")
+    mega = tmp_path / "artist" / ".megatmp.AbCd123"     # abandoned megatools stage
+    mega.write_bytes(b"x")
+    os.utime(mega, (old, old))
 
-    assert m.cleanup_orphaned_temp_files() == 1
+    assert m.cleanup_orphaned_temp_files() == 2
     assert not stale.exists()
+    assert not mega.exists()
     assert fresh.exists()
     assert keep.exists()