fix(images): allow the CDNs artwork actually lives on, add Deezer artist photos

The image proxy allowlist covered none of the hosts enrichment writes, so every
album cover answered 403: 305 covers sit on coverartarchive.org (which 302s to
archive.org and on to an ia*.us.archive.org node), 126 on mzstatic, 115 on
dzcdn, 26 on discogs.

Artist images were empty for a different reason — no working source. Fanart
needs a key the worker does not have, TheAudioDB and Discogs 404 on most names,
Wikidata needs an MBID that 638 of 734 artists lack, and Last.fm stopped
serving photos. Deezer needs no auth and its host is already allowlisted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workers/src/enrichment.service.ts

@@ -519,6 +519,20 @@ export class EnrichmentService {
       console.warn('[Enrich] Discogs image failed:', (err as Error).message);
     }
 
+    // 6. Deezer (by name, no auth). The five sources above cover almost nothing
+    // in this library: Fanart needs a key the worker does not have, TheAudioDB
+    // and Discogs 404 on most names, Wikidata needs an MBID that 638 of 734
+    // artists lack, and Last.fm stopped serving real artist photos.
+    try {
+      const deezerImage = await this.deezer.searchArtistImage(artistName);
+      if (deezerImage) {
+        await this.updateArtistImage(artistId, deezerImage);
+        return deezerImage;
+      }
+    } catch (err) {
+      console.warn('[Enrich] Deezer image failed:', (err as Error).message);
+    }
+
     // NOTE: Wikimedia Commons "by name" was previously the last fallback, but a
     // blind File-namespace text search ("<name> artist") routinely returns the
     // wrong image entirely (e.g. an unrelated person who shares the name). It has