Serve article images locally: /images proxy route with SSRF-guarded

upstream fetch, magic-byte validation, persistent /data/media cache,
immutable cache headers, CoverImage fallback component, og:image to
absolute proxy URL. Ported from technews 6f08da3.

src/components/ArticleCard.tsx

@@ -1,6 +1,7 @@
 import Link from 'next/link';
 import type { ArticleCard as Card } from '@/lib/queries';
 import { resolveCoverImage } from '@/lib/cover';
+import { CoverImage } from '@/components/CoverImage';
 import { formatRelativeTime } from '@/lib/format';
 
 export default function ArticleCard({ card }: { card: Card }) {
@@ -13,10 +14,9 @@ export default function ArticleCard({ card }: { card: Card }) {
         href={href}
         className="relative block aspect-[16/9] overflow-hidden bg-ink-100"
       >
-        <img
+        <CoverImage
           src={image}
           alt=""
-          loading="lazy"
           className="h-full w-full object-cover transition duration-300 group-hover:scale-[1.03]"
         />
       </Link>