fix(ap): boosted post keeps its cover when you don't follow the author
Boosting a post from someone you DON'T follow resolves the note via
resolveRemoteNote() (authorize_interaction/boost -> upsertBoostedNote),
which extracted images only from attachment. A Klonkt hosted-audio
post deliberately strips its cover from attachment (so Mastodon shows
the player card) and carries it in image instead — so the cover was
lost. Posts from FOLLOWED accounts go through mediaFromNote(), which
already falls back to image; resolveRemoteNote() now does the same.
Verified in isolation: cover extracted from image (object/string/array),
attachment still wins when present, no duplication, non-http rejected
(SSRF-safe). Full suite 45/45.
- src/services/ActivityPubService.js — image fallback in resolveRemoteNote
- CHANGELOG(.nl/.de).md — user-facing entry under Unreleased (3 languages)
Co-Authored-By: Claude <noreply@…>