fix(posts): link duplicate items to every post + prune bare shells

The native Patreon backfill flooded the feed with bare 'Post <id>' shells
(1589 for Anduo). Root cause: PostAttachment.sha256 was GLOBALLY unique, so a
non-art file reused across posts only ever linked to the first one, and
_capture_attachment created the Post before that dedup check — leaving later
posts with no image and no attachment. Duplicate IMAGES had the mirror gap:
attach_in_place returned duplicate_hash/duplicate_phash before _apply_sidecar,
so the second post got no provenance row, and the feed only rendered via
primary_post_id (one post per image).

Operator requirement: a duplicate item must show on EVERY post it appears in.
Unify the fix as link-not-suppress:

- importer: on duplicate_hash / duplicate_phash(larger_exists), append an
  image_provenance row for the new post (keep primary on the first). Both the
  download path (attach_in_place) and the filesystem path (_import_media).
- post_feed_service: render thumbnails by image_provenance UNION primary_post_id,
  so a cross-posted image shows on every post (and legacy primary-only images
  still show).
- PostAttachment: per-post uniqueness — drop UNIQUE(sha256), add partial
  UNIQUE(post_id, sha256) + partial UNIQUE(sha256) WHERE post_id IS NULL
  (migration 0043); _capture_attachment dedups per-(post,sha) over the shared
  sha-addressed blob, so no post is left bare.
- cleanup: new prune-bare-posts maintenance action (cleanup_service
  _bare_post_conditions shared by preview/count/delete per preview/apply parity;
  admin endpoint; PostMaintenanceCard). Deletes posts with zero image links
  (primary or provenance) AND zero attachments. Run after the feed fix so a
  hidden provenance link spares the post instead of deleting it.

Tests: dup image shows on both posts; dup attachment shows on both posts; feed
renders provenance-linked duplicates; prune-bare delete-path == preview.

Operator redeploys (migration 0043) then runs the prune to clear the shells.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/views/CleanupView.vue

@@ -9,6 +9,7 @@
     <MinDimensionCard class="mb-4" />
     <TransparencyAuditCard class="mb-4" />
     <SingleColorAuditCard class="mb-4" />
+    <PostMaintenanceCard class="mb-4" />
     <TagMaintenanceCard />
   </div>
 </template>
@@ -17,6 +18,7 @@
 import MinDimensionCard from '../components/cleanup/MinDimensionCard.vue'
 import TransparencyAuditCard from '../components/cleanup/TransparencyAuditCard.vue'
 import SingleColorAuditCard from '../components/cleanup/SingleColorAuditCard.vue'
+import PostMaintenanceCard from '../components/settings/PostMaintenanceCard.vue'
 // Reuse existing TagMaintenanceCard (FC-3k) as-is — it already handles
 // preview + commit of prune-unused-tags via the admin store. Operator
 // confirmed 2026-05-26: don't duplicate into a new UnusedTagsCard.