feat: offer the creator you already track as the one you subscribe to (388 E4)

**The verification the step asked for came back "not the schema".**
`Source.artist_id` is a plain FK so many sources per artist already works;
`POST /api/sources` already takes an `artist_id`; the add-source dialog already
has an artist autocomplete that attaches to an EXISTING artist; and
`SourceService.reassign` already moves a source between artists WITH post and
image re-attribution. A sweep for one-source-per-artist assumptions found only
`func.count()` calls — the opposite of assuming one.

So no parallel association table was built for a relationship the schema
already expresses (rule 28). What was missing is FC OFFERING the link, and that
is all this adds.

**Accepting adds a SOURCE. It never merges two artists.** That asymmetry sets
the whole posture: adding a source is trivially undone, while a wrong merge
silently mixes two creators' work and corrupts tagging, series and provenance
downstream with nothing left to tell them apart by. A test asserts the artist
count is unchanged by accepting.

The weights encode the judgement rather than a code path doing it — name 0.65,
declared 0.35, cut at 0.60 — so that:

* an EXACT name match alone proposes (same slug on both sides is strong, and
  demanding corroboration would propose almost nothing);
* a CONTAINMENT match alone does not ("art" sits inside "artgirl"), and short
  slugs are excluded from containment entirely because a 3-character slug is
  inside a great many longer ones;
* the declaration ALONE never proposes, because a creator may link another
  creator's Patreon and a link is not a claim of identity.

A guard test pins all three against WEIGHTS directly and says not to fix a
failure by moving the numbers.

Two corrections carried forward from earlier steps rather than rediscovered:

* The declaration is NOT read from `ExternalLink`. `SUPPORTED_HOSTS` is file
  hosts only and `host_for()` returns None for patreon.com, so no row is ever
  written for one — the same trap that caught E5 for Discord invites. It reads
  the raw body, because these links live in an `href` and `html_to_plain`
  discards attributes.
* `vanity` is not a column: C1 modelled the roster before any platform was
  characterised, which is exactly what `details` exists for. `vanity_or_none()`
  reads it from there and falls back to the URL's last segment, so a row
  written before the field was understood still resolves.

Two fixes during the writing. `accept()` first created a bare `Source()`,
skipping the platform/URL validation, duplicate check and #693 backfill-arming
that a hand-added source gets — a second, quieter way to create a source is how
two paths drift until one is subtly broken; it now goes through
`SourceService.create`. And the candidate query used a bare `exists().where()`,
which has no FROM to correlate against; now `select(...).exists()`.

Chained onto the roster sweep rather than given its own beat entry: a
suggestion can only be as good as the roster behind it, so any other cadence
would just propose from staler data.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LNXXULQDjVZmbuNa2G9mD9

backend/app/api/sources.py

@@ -5,6 +5,8 @@ from sqlalchemy import func, select
 
 from ..extensions import get_session
 from ..models import DownloadEvent, MembershipSync, PlatformMembership, Source
+from ..services.artist_membership_service import ArtistMembershipService
+from ..services.artist_membership_service import rescan as membership_rescan
 from ..services.membership_roster import roster_is_fresh
 from ..services.scheduler_service import active_platform_cooldowns, scheduler_status
 from ..services.source_service import (
@@ -343,3 +345,44 @@ async def trigger_membership_sync():
 
     sync_memberships.delay()
     return jsonify({"queued": True})
+
+
+# --- #388 E4: creator/membership suggestions ------------------------------
+#
+# Confirm-only. Accepting ADDS A SOURCE under the existing artist — it never
+# merges two artists, because adding a source is trivially undone and a wrong
+# merge silently mixes two creators' work with nothing left to separate them by.
+
+
+@sources_bp.route("/membership-suggestions", methods=["GET"])
+async def list_membership_suggestions():
+    async with get_session() as session:
+        return jsonify({"items": await ArtistMembershipService(session).list_pending()})
+
+
+@sources_bp.route("/membership-suggestions/<int:sid>/accept", methods=["POST"])
+async def accept_membership_suggestion(sid: int):
+    async with get_session() as session:
+        result = await ArtistMembershipService(session).accept(sid)
+        if result is None:
+            return _bad("suggestion_not_found", status=404)
+        await session.commit()
+    return jsonify(result)
+
+
+@sources_bp.route("/membership-suggestions/<int:sid>/dismiss", methods=["POST"])
+async def dismiss_membership_suggestion(sid: int):
+    async with get_session() as session:
+        result = await ArtistMembershipService(session).dismiss(sid)
+        if result is None:
+            return _bad("suggestion_not_found", status=404)
+        await session.commit()
+    return jsonify(result)
+
+
+@sources_bp.route("/membership-suggestions/rescan", methods=["POST"])
+async def rescan_membership_suggestions():
+    async with get_session() as session:
+        result = await membership_rescan(session)
+        await session.commit()
+    return jsonify(result)