Daily Art: Codex guardrails (atomic image, attribution/license, blocked lever)

Hardening before it runs further on the cycle:
- DB-lock/network: all HTTP (metadata + image) happens before any write; the write txn
  opens only at the brief INSERT and commits immediately. Images download to a temp file
  then atomic os.replace into cache (a reader never sees a half-written file).
- Site-timezone "daily" already used local_today() (same rhythm as the Brief) — confirmed.
- Attribution from day one: store + return title/artist/date/medium/department/credit/
  source_url/object_id/source + museum name + is_public_domain license marker + the full-
  res source URL (for a richer /art view later). UI can show: Title · Artist · The Met.
- "highlight != always beautiful": added a manual `blocked` flag on art_pool (excluded
  from picks) as the cheap curation lever; a featured override can follow.

Schema migrated (existing art tables get the new columns). 373 tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

goodnews/api.py

@@ -2267,11 +2267,15 @@ def create_app() -> FastAPI:
             response.headers["Cache-Control"] = _PRIVATE
             raise HTTPException(status_code=404, detail="No art yet.")
         response.headers["Cache-Control"] = _EDGE_FEED   # one piece a day, same for everyone
+        museums = {"met": "The Met", "aic": "Art Institute of Chicago", "si": "Smithsonian"}
         return {
             "date": a["art_date"], "object_id": a["object_id"], "title": a["title"],
             "artist": a["artist"], "date_text": a["date_text"], "medium": a["medium"],
             "department": a["department"], "credit": a["credit"], "source_url": a["source_url"],
-            "source": a["source"], "image_url": f"/api/art/image/{a['object_id']}",
+            "source": a["source"], "museum": museums.get(a["source"], a["source"]),
+            "is_public_domain": bool(a["is_public_domain"]),
+            "license": "Public Domain (CC0)" if a["is_public_domain"] else None,
+            "image_url": f"/api/art/image/{a['object_id']}",
         }
 
     @app.get("/api/art/image/{object_id}")