feat(import): materialize Trello image card covers

[bionicman]

Description

This is a focused follow-up to #605 and should be merged after it.

#605 preserves Trello cover colours and normal/full size, but deliberately
leaves selected image ingestion out of scope. This PR fills that gap:

• request only selected cover attachment metadata through Trello's nested board
  response;
• resolve uploaded attachments and uploaded-background renditions without
  making per-card metadata requests;
• download at most two images concurrently with HTTPS and Trello CDN checks,
  validated redirects, timeout, byte and decoded-pixel limits;
• materialise successful images as ordinary Kan card attachments and generate
  the existing responsive cover previews;
• create the attachment and select it in one database transaction without
  inventing historical card activity;
• clean up stored objects after storage or database failures, then retain the
  Trello colour fallback or continue without a cover instead of aborting the
  whole board import.

Remote Trello URLs and credentials are not stored, and authorization is never
forwarded to a redirected host. I exercised the importer against two live
Trello boards locally; it materialised all 14 selected image covers found in
that sample. The same patch is now running in our downstream deployment.

This is currently a stacked PR, so GitHub will also show the parent #605
commits until that PR lands. The follow-up itself is the single
feat(import): materialize Trello image card covers commit.

Verification

• complete API suite: 206 tests
• focused importer and download policy suite: 60 tests
• card-cover repository integration coverage, including transactional
  rollback
• API, DB and E2E typechecks
• focused Prettier and ESLint checks
• local live-import trial with Kan-controlled image URLs
• no UI changes; screenshots are not applicable

Type of change

• Bug fix
• Feature (requires an approved issue — see below)
• Refactor / chore
• Documentation

Checklist

• I have linked the related issue below
• My code follows the existing style and conventions
• I have tested my changes locally
• I have included screenshots for any UI changes (not applicable: no UI
  changes)

Linked issue

Part of #155. Depends on #605.