fix(subscriptions): hide sidecar synthetic Sources + prefer real on lookup

Two coupled bugs surfaced 2026-05-31 by the Subscriptions UI showing
"phantom" subscriptions like `sidecar:patreon:dpmaker`:

1. `SourceService.list()` returned every Source, no filter on URL.
   alembic 0022 (2026-05-26) consolidated old per-post-URL Sources into
   one canonical row per (artist, platform); when no real campaign URL
   was salvageable it rewrote the canonical to `sidecar:<plat>:<slug>`
   enabled=false as a disabled anchor. The UI then listed those
   anchors as if they were polls — disabled, but visible. Fix: `list()`
   excludes `url LIKE 'sidecar:%'` by default; `include_synthetic=True`
   opts back in for admin tooling.

2. `importer._source_for_sidecar` picked the lowest-id Source for
   (artist, platform). When alembic 0022 had rewritten a per-post row
   into a synthetic anchor (lower id) AND the operator later added the
   real subscription (higher id), every gallery-dl download silently
   attached its Post to the SYNTHETIC instead of the real Source. Fix:
   prefer a non-`sidecar:%` URL when one exists; fall back to the
   synthetic; only create a new synthetic when nothing exists for
   (artist, platform).

alembic 0028 is the data half: for every (artist, platform) with both
a synthetic AND a real Source, pre-merge Post+ImageProvenance
collisions on the canonical, bulk-repoint Posts/ImageProvenance/
DownloadEvent.source_id onto the real Source, and delete the
synthetic. Lone synthetics (no real twin) are left intact — they
anchor real imported content the operator may still want; the
list-filter hides them so they no longer surface as phantoms.

tests/test_source_service.py

@@ -1,7 +1,7 @@
 import pytest
 from sqlalchemy import select
 
-from backend.app.models import Artist
+from backend.app.models import Artist, Source
 from backend.app.services.source_service import (
     KNOWN_PLATFORMS,
     ArtistNotFoundError,
@@ -133,3 +133,39 @@ async def test_update_changes_fields(db):
     updated = await svc.update(rec.id, enabled=False, config_overrides={"videos": False})
     assert updated.enabled is False
     assert updated.config_overrides == {"videos": False}
+
+
+@pytest.mark.asyncio
+async def test_list_hides_sidecar_synthetic_anchors(db):
+    """Filesystem-import synthetic Sources (url='sidecar:<platform>:<slug>',
+    enabled=False — see importer._source_for_sidecar) used to leak into the
+    Subscriptions UI as phantom subscriptions because list() didn't filter
+    them. They aren't pollable feeds; hide by default."""
+    artist = await _artist(db, "Alice")
+    real = Source(
+        artist_id=artist.id, platform="patreon",
+        url="https://patreon.com/alice", enabled=True, config_overrides={},
+    )
+    synthetic = Source(
+        artist_id=artist.id, platform="patreon",
+        url="sidecar:patreon:alice", enabled=False, config_overrides={},
+    )
+    db.add_all([real, synthetic])
+    await db.commit()
+
+    svc = SourceService(db)
+    visible = await svc.list()
+    visible_urls = {s.url for s in visible}
+    assert "https://patreon.com/alice" in visible_urls
+    assert "sidecar:patreon:alice" not in visible_urls
+
+    # Same filter applies to the artist-scoped list path (the artist detail
+    # page hits /api/sources?artist_id=N).
+    artist_scoped = await svc.list(artist_id=artist.id)
+    assert {s.url for s in artist_scoped} == {"https://patreon.com/alice"}
+
+    # include_synthetic=True opts back in for admin tooling.
+    everything = await svc.list(include_synthetic=True)
+    assert {s.url for s in everything} >= {
+        "https://patreon.com/alice", "sidecar:patreon:alice",
+    }