fix: proxy all images through reqwest to bypass WebKit TLS (#163)

When image cache is disabled or unavailable, images were returned
as original HTTPS URLs for WebKit to load directly. On AppImage
distros where GnuTLS can't find system CA certs, this fails silently.

Now all images go through reqwest (rustls, bundled CA) and are
written to temp files as file:// URLs. WebKit never needs to
resolve HTTPS for images.

cc

src/lib/services/imageCacheService.ts

@@ -49,7 +49,9 @@ export async function getCachedImageUrl(url: string): Promise<string> {
       resolvedUrls.set(url, resolved);
       return resolved;
     } catch {
-      // On failure, use original URL
+      // Backend failed to proxy — use original URL as last resort.
+      // This may fail on AppImage distros with broken GnuTLS but
+      // is better than showing nothing on distros where WebKit works.
       resolvedUrls.set(url, url);
       return url;
     } finally {