feat(ingest): localize inline post-body images to local copies (Phase 2)

Render a post body faithfully by serving our stored copies of inline
images instead of hotlinking the public CDN. The join key is the CDN
filehash (32-hex MD5) shared between a body <img src> and the media URL
we downloaded (the same identity extract_media dedups by):

- utils.paths.filehash_from_url — one source of truth for the extractor;
  patreon_client._filehash now delegates so capture- and render-time
  hashing cannot drift.
- ImageRecord gains source_url (provenance) + source_filehash (indexed
  match key); migration 0051.
- the per-media sidecar carries the file's source_url; the importer
  persists it (NULL-only) on the ImageRecord via _apply_sidecar.
- post_feed_service.get_post remaps body <img src> -> /images/<path> for
  every inline image whose filehash maps to a stored image of THIS
  artist; unmatched / pre-Phase-2 images keep hotlinking.

Pre-existing on-disk images have no filehash yet, so they fall back to
hotlinking until re-downloaded; localization is forward-looking.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_html_sanitize.py

@@ -1,4 +1,8 @@
-from backend.app.utils.html_sanitize import sanitize_post_html
+from backend.app.utils.html_sanitize import (
+    extract_img_srcs,
+    rewrite_img_srcs,
+    sanitize_post_html,
+)
 
 
 def test_none_and_blank_return_none():
@@ -52,3 +56,40 @@ def test_headings_lists_and_images_survive():
 def test_image_javascript_src_dropped():
     out = sanitize_post_html('<img src="javascript:alert(1)" alt="x">')
     assert "javascript:" not in out
+
+
+# --- inline-image localization helpers (#830 Phase 2) ----------------------
+
+
+def test_extract_img_srcs_in_order_deduped():
+    html = (
+        '<p>a</p><img src="https://cdn.test/1.jpg">'
+        '<img alt="x" src="https://cdn.test/2.jpg" width="10">'
+        '<img src="https://cdn.test/1.jpg">'
+    )
+    assert extract_img_srcs(html) == [
+        "https://cdn.test/1.jpg",
+        "https://cdn.test/2.jpg",
+    ]
+
+
+def test_extract_img_srcs_empty():
+    assert extract_img_srcs(None) == []
+    assert extract_img_srcs("<p>no images</p>") == []
+
+
+def test_rewrite_img_srcs_swaps_only_mapped():
+    html = (
+        '<img src="https://cdn.test/1.jpg" alt="a">'
+        '<img src="https://cdn.test/2.jpg">'
+    )
+    out = rewrite_img_srcs(html, {"https://cdn.test/1.jpg": "/images/local/1.jpg"})
+    assert 'src="/images/local/1.jpg"' in out
+    assert 'alt="a"' in out  # other attributes preserved
+    assert 'src="https://cdn.test/2.jpg"' in out  # unmapped left alone
+
+
+def test_rewrite_img_srcs_noop_on_empty():
+    html = '<img src="https://cdn.test/1.jpg">'
+    assert rewrite_img_srcs(html, {}) == html
+    assert rewrite_img_srcs(None, {"a": "b"}) is None