fix(thumbnails): derive URL from stored thumbnail_path, not (sha256, mime)

The showcase/gallery/artist/series/post-feed APIs were constructing
thumbnail URLs from (sha256, mime). The MIME-based extension predicate
("png if image/png or image/gif else jpg") DISAGREED with the
thumbnailer's actual on-disk extension predicate ("png if alpha else
jpg"). Result: every PNG source without transparency 404'd (URL asked
.png, disk had .jpg); every WebP/AVIF source with transparency 404'd
(URL asked .jpg, disk had .png) — despite the thumbnail file existing
on disk.

The backfill task couldn't catch these because backfill checks the
ACTUAL thumbnail_path stored on the record (correct), not the URL the
browser fetches (broken derivation). So records with valid on-disk
thumbnails kept showing as broken in the UI no matter how many times
backfill ran.

Operator-flagged 2026-05-30: "the generate thumbnails function appears
to not catch all of the failed thumbnail cases" — turned out to not be
a backfill bug at all.

Fix: thumbnail_url now takes (thumbnail_path, sha256, mime) and returns
the stored path verbatim — Quart serves /images/* 1:1 from the volume
(frontend.py:20-36), so the URL IS the disk path. Falls back to the old
sha256+mime derivation only when thumbnail_path is NULL (thumbnailer
hasn't run yet); that URL will 404 in the browser until backfill catches
it, same as before the path was tracked.

All 8 callers updated: showcase_service, gallery_service (2 sites),
artist_service, series_service, post_feed_service, tag_directory_service,
artist_directory_service. The four sites whose query was raw-tuple now
also SELECT ImageRecord.thumbnail_path.

Net effect: every record that has a valid on-disk thumbnail will now
render correctly, regardless of which extension the thumbnailer chose,
without any DB migration or backfill rerun needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/services/gallery_service.py

@@ -90,9 +90,27 @@ class TimelineBucket:
     count: int
 
 
-def thumbnail_url(sha256_hex: str, mime: str) -> str:
-    # Quart serves /images/* via the frontend blueprint (FC-1); thumbnails go
-    # under /images/thumbs/. The MIME determines the extension.
+def thumbnail_url(thumbnail_path: str | None, sha256_hex: str, mime: str) -> str:
+    """Return the URL to fetch a thumbnail.
+
+    Prefers the stored thumbnail_path verbatim — Quart serves /images/*
+    1:1 from the volume (frontend.py:20-36), so the URL IS the disk
+    path. Falls back to deriving from (sha256, mime) only when the
+    record's thumbnail_path is NULL (thumbnailer hasn't run yet); that
+    URL will 404 until backfill catches it, same as before the path
+    was tracked.
+
+    Pre-2026-05-30 this was derived only from (sha256, mime), which
+    disagreed with the actual on-disk extension when the thumbnailer
+    chose its format from transparency rather than MIME — every PNG
+    source without alpha (extension was .jpg on disk) and every WebP
+    source with alpha (extension was .png on disk) silently 404'd
+    despite the thumbnail file existing.
+    """
+    if thumbnail_path:
+        return thumbnail_path
+    # Fallback for records with no thumbnail recorded yet — preserves
+    # prior behavior (URL exists but 404s until backfill regenerates).
     ext = ".png" if mime in ("image/png", "image/gif") else ".jpg"
     bucket = sha256_hex[:3]
     return f"/images/thumbs/{bucket}/{sha256_hex}{ext}"
@@ -198,7 +216,7 @@ class GalleryService:
                 created_at=record.created_at,
                 effective_date=eff_date,
                 posted_at=posted_at,
-                thumbnail_url=thumbnail_url(record.sha256, record.mime),
+                thumbnail_url=thumbnail_url(record.thumbnail_path, record.sha256, record.mime),
                 artist=artists.get(record.id),
             )
             for record, posted_at, eff_date in rows
@@ -306,7 +324,7 @@ class GalleryService:
             "integrity_status": record.integrity_status,
             "created_at": record.created_at.isoformat(),
             "posted_at": posted_at.isoformat() if posted_at else None,
-            "thumbnail_url": thumbnail_url(record.sha256, record.mime),
+            "thumbnail_url": thumbnail_url(record.thumbnail_path, record.sha256, record.mime),
             "image_url": f"/images/{record.path.split('/images/', 1)[-1]}",
             "artist": (
                 {"id": artist.id, "name": artist.name, "slug": artist.slug}