feat(images): downscale remote (fediverse) avatars via a signed proxy
Remote avatars live on other servers, so the browser shrank full-res line-art to ~44px
(jagged). Fetch them once (SSRF-safe via safeFetch), downscale identically (lanczos -> WebP),
cache, serve. HMAC-signed proxy URLs → not an open resizer.
- services/ActivityPubService.js — export safeFetch
- services/ThumbnailService.js — getRemoteThumbnail + signed imgProxyUrl/verifyImg; +128px size
- server.js — GET /img/a/:w signed proxy route
- middleware/render.js — avatar(url,w) helper (local thumb / remote proxy)
- views: news.ejs, fedi-node.ejs, following.ejs avatars -> avatar()