Proxy miniapp station artwork

[Mr-Tao]

Summary

• Add a narrow miniapp artwork proxy for TuneIn/RadioTime station images.
• Use the proxy for preset, now-playing, and selected-preset artwork in the dashboard.
• Fix the selected-preset sidebar condition so it checks container_art before rendering preset artwork.

Rationale

Some browsers may block or fail to render station artwork when the miniapp embeds external TuneIn CDN image URLs directly. Serving the same artwork through the local SoundCork origin avoids that browser-specific behavior while keeping the miniapp HTML stable.

Implementation Details

• Added /miniapp/artwork?url=....
• Only http and https URLs on tunein.com or radiotime.com hostnames are proxied.
• The proxy follows redirects, checks that the upstream response is an image, enforces a 2 MB size limit, and returns Cache-Control: public, max-age=86400.
• There is no persistent disk cache; images are fetched and returned per request, with normal browser caching allowed by response headers.
• Dashboard templates now call miniapp_artwork_url() for preset cards, selected speaker now-playing artwork, and selected-preset artwork.

Tests / Validation

• black --check --target-version py312 soundcork/miniapp.py soundcork/tests/test_miniapp.py
• isort --check-only soundcork/miniapp.py soundcork/tests/test_miniapp.py
• python -m py_compile soundcork/miniapp.py soundcork/tests/test_miniapp.py
• timeout 60s /home/hideo/opensource/soundcork-live/.venv/bin/python -m pytest -q soundcork/tests/test_miniapp.py passed with 5 passed, 1 warning in a clean worktree based on origin/main.
• Live validation on a local UDR showed /miniapp/artwork?url=http%3A%2F%2Fcdn-profiles.tunein.com%2Fs25574%2Fimages%2Flogoq.png%3Ft%3D1 returning 200 image/png, and Firefox displayed station logos after reload.

Compatibility and Risk

The endpoint is intentionally not a general-purpose HTTP proxy. Unsupported hosts are rejected with 400, non-image responses with 502, and large responses with 502.

Non-Goals / Follow-Ups

• This PR does not add persistent artwork storage or a server-side disk cache.
• This PR does not modify TuneIn/BMX playback behavior.