fix(images): downscale remote (federated) covers + feed media via the proxy
thumb() only rewrote LOCAL /media covers; a remote (federated) cover URL passed through
unchanged → loaded full-res from the origin → browser-downscaled jagged (esp. line-art).
Route remote http(s) covers + timeline feed media through the same signed downscale proxy.