feat: add card covers

[bionicman]

Description

Adds optional colour and attachment-backed image covers to cards.

I built this while moving several teams from Trello to Kan. Covers are used as
quick visual landmarks on busy boards, so retaining the interaction matters to
the migration. The implementation continues the colour-cover direction explored
in #515 and keeps the native model provider-neutral.

• choose a Kan palette colour, an existing image attachment, or upload a new
  image;
• render normal and full covers on authenticated and public boards and in card
  detail;
• generate bounded 320/640/1280 WebP previews and resolve signed URLs lazily in
  batches;
• record cover changes in card activity and webhook payloads;
• let each browser show covers as prominent, subdued or hidden without changing
  board data;
• preserve Trello cover colour and normal/full size in the built-in importer;
• preserve full colour covers when duplicating cards or creating boards from
  templates, while resetting image-only presentation state because attachments
  themselves are not copied by those operations.

Uploaded covers reuse ordinary card attachments. The card stores only selected
cover state, so there is no parallel asset model and removing a cover does not
delete the attachment.

I realise that decoration features have a noticeable effect on the interface
and may deserve a wider product discussion. The feature is deliberately
non-invasive for existing users: cards without covers keep their current
appearance, and a local display preference lets each user make covers
prominent, subdued or hidden. This preserves a familiar workflow for teams
moving from Trello without imposing it on people who prefer Kan's clean default
style. I am open to constructive suggestions on the UX and boundaries.

This PR is intended to be considered together with the board-background work in
#606. They are separate review units, but solve the same navigation and
personalisation problem on cards and boards respectively.

The built-in importer does not materialise a selected Trello image attachment.
That is intentionally kept as a follow-up: it needs a bounded authenticated
downloader, redirect validation and object-store rollback, and should not be
hidden inside this already substantial UI/model change. No remote Trello URL is
stored or rendered at runtime.

Screenshots

Authenticated board, prominent covers:

Card detail and cover picker:

Account display preference:

Anonymous public board:

Verification

• branch refreshed onto current upstream/main
• targeted API tests: 73 passed
• targeted web tests: 11 passed
• repository integration tests: 8 passed
• API, DB and shared typechecks
• web typecheck (blocked by the same two bootstrap.cjs and two board
  visibility errors present on upstream/main)
• entirely new source/test files pass package ESLint and Prettier checks
• self-hosted Playwright cover scenario
• synthetic dark-theme desktop, mobile, settings and public screenshots
• screenshot fixture and capture checksums verified

Type of change

• Bug fix
• Feature (requires an approved issue — see below)
• Refactor / chore
• Documentation

Checklist

• I have linked the related issue below
• My code follows the existing style and conventions
• I have tested my changes locally
• I have included screenshots for any UI changes

Linked issue

Part of #155