feat(provenance): capture which archive an extracted image came from (#87)

Images pulled out of a .zip/.rar previously kept no record of WHICH archive
they came from — the member->archive link was computed during extraction and
discarded, leaving only image->post. So the provenance modal could only scope
attachments to the whole post, showing every archive a 'High Resolution Files'
bundle carried instead of the one a given file lives in.

- ImageProvenance.from_attachment_id: nullable FK -> post_attachment.id
  (SET NULL), migration 0055.
- importer: _import_archive stamps from_attachment_id on every member's
  provenance row for the post (new + superseded + deduped members), resolving
  the archive's own PostAttachment by (post, sha). Post-pass UPDATE, NULL-only
  and idempotent, so it doesn't touch the dedup/supersede branches and the
  backfill is safe to re-run. Nested members link to the outer stored archive.
- provenance_service.for_image: when the originating post's provenance row
  records from_attachment_id, return ONLY that archive; else fall back to the
  primary-post scoping from 068def2.
- ProvenancePanel: heading pluralizes ('Attachment' for a single file).
- Backfill: re-running reextract_archive_attachments (ArchiveReextractCard)
  routes through _import_archive and stamps existing rows — no new code.

Tests: capture stamps on fresh import, nested-archive attribution, per-post
archive on dedup; for_image filters to the containing archive; reextract
backfill stamps the link.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_reextract_archives.py

@@ -74,10 +74,13 @@ def test_reextract_links_archive_members_to_post(db_sync, tmp_path, monkeypatch)
     with zipfile.ZipFile(arc, "w") as zf:
         zf.writestr("inside.jpg", _jpeg("red"))
     sha = hashlib.sha256(arc.read_bytes()).hexdigest()
-    db_sync.add(PostAttachment(
+    att = PostAttachment(
         post_id=post.id, artist_id=artist.id, sha256=sha, path=str(arc),
         original_filename=arc.name, ext="", size_bytes=arc.stat().st_size,
-    ))
+    )
+    db_sync.add(att)
+    db_sync.flush()
+    att_id = att.id
     db_sync.commit()
 
     summary = cleanup_service.reextract_archive_attachments(
@@ -94,6 +97,9 @@ def test_reextract_links_archive_members_to_post(db_sync, tmp_path, monkeypatch)
     ).scalars().all()
     assert len(prov) == 1
     assert prov[0].image_record_id == images[0].id
+    # Milestone #87: re-extraction stamps which archive the member came from —
+    # this is the backfill path for pre-existing opaque archives.
+    assert prov[0].from_attachment_id == att_id
 
     # Idempotent — a second run imports nothing new (member dedups by sha256).
     again = cleanup_service.reextract_archive_attachments(