fix(images): allow the CDNs artwork actually lives on, add Deezer artist photos

The image proxy allowlist covered none of the hosts enrichment writes, so every
album cover answered 403: 305 covers sit on coverartarchive.org (which 302s to
archive.org and on to an ia*.us.archive.org node), 126 on mzstatic, 115 on
dzcdn, 26 on discogs.

Artist images were empty for a different reason — no working source. Fanart
needs a key the worker does not have, TheAudioDB and Discogs 404 on most names,
Wikidata needs an MBID that 638 of 734 artists lack, and Last.fm stopped
serving photos. Deezer needs no auth and its host is already allowlisted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/routes/images.routes.ts

@@ -10,12 +10,24 @@ const ALLOWED_HOSTS = new Set([
   'images.genius.com',
   'commons.wikimedia.org',
   'e.snmc.io',
+  // Cover Art Archive 302s to the apex host, which then redirects on to an
+  // ia*.us.archive.org node. The suffix below covers the node, not the apex.
+  'archive.org',
 ]);
 
 // Wildcard suffixes — any subdomain of these is allowed.
+//
+// The CDNs below are where enrichment actually stores artwork: of 572 albums
+// with a cover, 126 sit on mzstatic (iTunes), 115 on dzcdn (Deezer) and 26 on
+// discogs, and every coverartarchive.org URL 302s to an ia*.us.archive.org
+// node. Without these the proxy answered 403 for every cover in the library.
 const ALLOWED_SUFFIXES = [
   '.coverartarchive.org',
   '.musicbrainz.org',
+  '.archive.org',
+  '.mzstatic.com',
+  '.dzcdn.net',
+  '.discogs.com',
 ];
 
 function isAllowed(hostname: string): boolean {