Fetch artwork offered only over http for the https page (#90)

Through ipodderx.sdf1.net the page is https, the browser upgrades an http:// image to https,
and a host with no https, such as The Secret Cabal's CDN, answers nothing, so no artwork. On an
https page, the page now asks /api/art for those, and ipx fetches them. It only fetches an
address some feed or entry names as its artwork, and only an image, up to 5 MB, so the route
cannot be pointed at anything else on the network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/db.rs

@@ -1313,6 +1313,14 @@ impl Db {
     }
 
     /// False when they do not subscribe to it, since there is then no row in their list to pin.
+    /// Whether a feed or an entry names `url` as its artwork: the only addresses /api/art will
+    /// fetch, so the web server cannot be pointed at anything else.
+    // ponytail: entries.image is unindexed, a scan per http:// image; index it if that shows up.
+    pub async fn names_image(&self, url: &str) -> Result<bool> {
+        Ok(feeds::Entity::find().filter(feeds::Column::Image.eq(url)).count(&self.orm).await? > 0
+            || entries::Entity::find().filter(entries::Column::Image.eq(url)).count(&self.orm).await? > 0)
+    }
+
     pub async fn set_pinned(&self, user_id: i64, feed_id: &str, on: bool) -> Result<bool> {
         let r = subscriptions::Entity::update_many()
             .col_expr(subscriptions::Column::Pinned, Expr::val(on).into())
@@ -1800,6 +1808,19 @@ mod tests {
         assert!(!order_sql("x'; --", "asc").contains("x'"));
     }
 
+    #[tokio::test]
+    async fn only_artwork_a_feed_names_is_fetched_for_the_page() {
+        let db = Db::memory().await.unwrap();
+        db.exec_for_test(
+            "INSERT INTO feeds (id, url, image) VALUES ('f','u','http://cdn.example/show.jpg');
+             INSERT INTO entries (feed_id, guid, first_seen, image) VALUES ('f','a',0,'http://cdn.example/ep.jpg');",
+        ).await
+        .unwrap();
+        assert!(db.names_image("http://cdn.example/show.jpg").await.unwrap());
+        assert!(db.names_image("http://cdn.example/ep.jpg").await.unwrap());
+        assert!(!db.names_image("http://192.168.1.1/admin").await.unwrap());
+    }
+
     #[tokio::test]
     async fn deleting_a_shared_file_asks_about_everyone_else() {
         let db = Db::memory().await.unwrap();