TB-121: harden book cover loading

[hehetoshang]

Summary

• route every book-cover surface through one policy gate that only accepts bounded raster HTTP(S) content
• retain credentials only for the configured Talebook origin; use a DNS-validated, address-pinned, credential-free Tauri downloader for explicitly allowed public cover origins
• revalidate redirects, enforce 5 MiB and image-dimension limits, deduplicate concurrent loads, and clean up object URLs
• add focused SSRF, credential, redirect, size, format, surface-coverage, cleanup, and retry-cooldown regressions

Verification

• pnpm test (360 passed)
• pnpm typecheck
• pnpm lint (no errors; existing warnings only)
• cargo test --manifest-path src-tauri/Cargo.toml --lib cover_fetch::tests (3 passed)
• pnpm build
• git diff --check

Closes TB-121