feat(ingest): localize inline post-body images to local copies (Phase 2)

Render a post body faithfully by serving our stored copies of inline
images instead of hotlinking the public CDN. The join key is the CDN
filehash (32-hex MD5) shared between a body <img src> and the media URL
we downloaded (the same identity extract_media dedups by):

- utils.paths.filehash_from_url — one source of truth for the extractor;
  patreon_client._filehash now delegates so capture- and render-time
  hashing cannot drift.
- ImageRecord gains source_url (provenance) + source_filehash (indexed
  match key); migration 0051.
- the per-media sidecar carries the file's source_url; the importer
  persists it (NULL-only) on the ImageRecord via _apply_sidecar.
- post_feed_service.get_post remaps body <img src> -> /images/<path> for
  every inline image whose filehash maps to a stored image of THIS
  artist; unmatched / pre-Phase-2 images keep hotlinking.

Pre-existing on-disk images have no filehash yet, so they fall back to
hotlinking until re-downloaded; localization is forward-looking.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_post_feed_service.py

@@ -438,6 +438,62 @@ async def test_get_post_returns_sanitized_html_body(db):
     assert "<script>" not in item["description_html"]
 
 
+@pytest.mark.asyncio
+async def test_get_post_localizes_inline_images(db):
+    """#830 Phase 2: a body <img src=CDN> whose filehash matches a stored image
+    of this artist is rewritten to the local /images path; an unmatched src is
+    left hotlinking."""
+    artist = await _seed_artist(db, "alice-inline")
+    src = await _seed_source(db, artist.id, "patreon", "https://p/alice-inline")
+    fh = "0123456789abcdef0123456789abcdef"
+    matched = f"https://cdn.test/p/{fh}/img.png"
+    unmatched = "https://cdn.test/p/ffffffffffffffffffffffffffffffff/other.png"
+    p = await _seed_post(
+        db, src.id, external_id="INLINE", post_date=datetime.now(UTC),
+        description=f'<p>x</p><img src="{matched}"><img src="{unmatched}">',
+    )
+    db.add(ImageRecord(
+        path="/images/alice-inline/patreon/post/01_img.png",
+        sha256=f"{p.id:064d}",
+        size_bytes=10, mime="image/png", width=10, height=10,
+        origin="downloaded", primary_post_id=p.id, artist_id=artist.id,
+        source_url=matched, source_filehash=fh,
+    ))
+    await db.commit()
+
+    item = await PostFeedService(db).get_post(p.id)
+    html = item["description_html"]
+    assert 'src="/images/alice-inline/patreon/post/01_img.png"' in html
+    assert matched not in html  # CDN src swapped out
+    assert unmatched in html    # no local copy → still hotlinked
+
+
+@pytest.mark.asyncio
+async def test_get_post_inline_image_scoped_to_artist(db):
+    """A matching filehash owned by a DIFFERENT artist must not leak into this
+    post's body — localization is artist-scoped."""
+    a1 = await _seed_artist(db, "owner-art")
+    a2 = await _seed_artist(db, "other-art")
+    src = await _seed_source(db, a1.id, "patreon", "https://p/owner-art")
+    fh = "abcabcabcabcabcabcabcabcabcabc12"
+    cdn = f"https://cdn.test/p/{fh}/x.png"
+    p = await _seed_post(
+        db, src.id, external_id="SCOPED", post_date=datetime.now(UTC),
+        description=f'<img src="{cdn}">',
+    )
+    # The only image with this filehash belongs to a DIFFERENT artist.
+    db.add(ImageRecord(
+        path="/images/other/x.png", sha256=f"{p.id:064d}",
+        size_bytes=10, mime="image/png", width=10, height=10,
+        origin="downloaded", artist_id=a2.id,
+        source_url=cdn, source_filehash=fh,
+    ))
+    await db.commit()
+
+    item = await PostFeedService(db).get_post(p.id)
+    assert cdn in item["description_html"]  # not localized (wrong artist)
+
+
 @pytest.mark.asyncio
 async def test_get_post_returns_external_links(db):
     artist = await _seed_artist(db, "alice-extlinks")