Candidate covers are back — proxied same-origin, CSP untouched.
Fixed
- The v0.9.17 self-contained Content-Security-Policy silently blocked
ComicVine candidate covers in the Add-series picker and Library-import
proposals (they were hotlinked to CV's CDN). Covers now render through a
new authenticated same-origin proxy (/api/v1/metadata/cover) that only
fetches allowlisted ComicVine media hosts — every redirect hop re-checked
against the allowlist — verifies responses are real images by magic bytes,
caps sizes, and bounds concurrency and caching. The CSP is unchanged.
(FRG-META-021)