images: harden the cache per Codex audit (SSRF-safe, cache-only endpoint, WebP-only)

Blocker fixes for the image cache:
- /api/img/{id} now serves cache HITS ONLY and is restricted to ACCEPTED, CANONICAL
  articles. It never fetches — the cycle (newsimg.warm) owns all fetching — so the
  public endpoint has no SSRF/worker-exhaustion surface. Dropped 1-year immutable
  caching (image_url can change) → public, max-age=86400.
- newsimg._safe_fetch: SSRF-safe (reuses enrich._host_is_public + _NoRedirect, http(s)
  only, every redirect hop re-validated, body capped). _FetchError distinguishes
  permanent refusals (negative-cached via a .fail marker) from transient errors (retry).
- _encode re-encodes only decoded RASTER images to WebP and REJECTS everything else
  (SVG, undecodable, decompression bombs via MAX_IMAGE_PIXELS, pathological dimensions);
  originals are never retained. prune() also sweeps stale .fail markers.
- Concurrency: fetching only runs inside the cycle lock; writes stay atomic.

Smaller fixes:
- share.py visible image has onerror→this.remove() (degrade to the text unfurl, no
  broken icon when an image isn't cached yet).
- share-page Back follows history only on a SAME-ORIGIN referrer (never bounce to an
  external site); menu now honors Escape + resets crossing back to desktop (HubBar parity).

Tests: private host, redirect-to-private, hostile SVG/non-image, transient-vs-permanent
failure, LRU prune, warm (accepted+canonical only, idempotent), cache-only endpoint
(404 on not-cached/unaccepted/duplicate, never fetches), share chrome parity. 441 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_share.py

@@ -105,3 +105,15 @@ def test_complete_page_is_cached_and_served_from_cache(app_complete):
     assert 1 in api._SHARE_CACHE                       # finished page cached
     r2 = tc.get("/a/1")                                # second hit served from cache
     assert r2.status_code == 200 and r2.text == r1.text
+
+
+def test_share_chrome_parity_and_fallbacks():
+    """HubBar-replica parity Codex asked for: Back only follows a SAME-ORIGIN referrer,
+    the menu honors Escape, and a failed image removes itself (clean text unfurl)."""
+    from goodnews import share
+    html = share.render_share_page(
+        {"id": 7, "title": "T", "image_url": "https://x/p.jpg", "canonical_url": "https://s/x",
+         "source_name": "S"}, "https://upbeatbytes.com")
+    assert "origin===location.origin" in html          # Back requires same-origin referrer
+    assert "'Escape'" in html or "Escape" in html       # menu closes on Escape (parity)
+    assert 'onerror="this.remove()"' in html            # broken image degrades to text unfurl