REV-192: catalogue illustrations

Implementation: backend PR #491.

The Collection character grids requested existing mirrored images through the guest catalogue media endpoint. Species and character paths were incorrectly checked against card_images, which only tracks individual card artwork. Read-only VPS checks confirmed that species/9.webp and characters/absalom.webp existed on disk but returned HTTP 404 publicly.

The API now permits only canonical species/character filenames associated with the matching game's catalogue identities. Unknown identities and private paths remain unavailable. No filesystem permissions, raw /api/images access, database records, image files or mobile application data are changed.

The example Tortank artwork URLs for sv03.5/200 and g1/17,18 returned HTTP 200. API logs nevertheless recorded image-route HTTP 429 responses at the time of the user's screenshots. The 240-image/minute/IP budget is now a separate, bounded 1,200-image budget, covering twenty sixty-thumbnail pages. A route test reproduced the old failure at image 241 and verifies rejection at image 1,201. This is not unlimited access and does not relax image publication checks.

Verification

• Three test-first cycles: species 404, character 404, image 241 returning 429.
• API typecheck and 1,170 tests pass locally (Node 24 runtime; the installed default Node 22.11 is older than the package's required Node 22.18 minimum).
• Raw private paths, unpublished sealed images, traversal-like/invalid names, MIME, redirect and byte limits remain covered by the regression suite.
• No migration is required. Merge, API deployment and native functional verification are pending; PR creation does not activate the fix on the VPS.
• A character without a real mirrored illustration retains its initials fallback.