Stored-image proxy: restrict passthrough to raster types

[sparkyfen]

Context

proxyStoredImage in src/lib/server/image-proxy.ts streams a stored image back to the admin browser for the avatar and ref-image endpoints, and now for the artist lookup (#288). It forwards any image/* media type inline. Rasters are all it needs to serve; the storage allowlist already limits what Sona writes (#254), but the proxy itself does not apply the same allowlist to what it reads back, and an admin-set image URL is not guaranteed to point at Sona's own storage.

Noticed during the #288 review. Pre-existing; the #288 change did not widen it (it only made the type comparison case-insensitive).

Scope

• In proxyStoredImage, pass through only the raster types the storage layer accepts (reuse its allowlist) and demote anything else to application/octet-stream with Content-Disposition: attachment, or refuse it.
• Consider adding a Content-Security-Policy: sandbox header to the proxy response as a second layer.
• Tests in src/lib/server/image-proxy.test.ts for an allowed raster, a non-raster image type, and a non-image type.

Rollout

Code-only; rides the normal deploy. No per-fork step.

[linear-code]

SONA-221