Move cover bytes to filesystem storage

docker-compose.yml

@@ -26,6 +26,9 @@ services:
       # The bookmarks database. Host is the compose service name; the password
       # comes from .env so it is never committed.
       DATABASE_URL: ${DATABASE_URL:-postgres://bookmarks:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/bookmarks?sslmode=disable}
+      # Required path inside the API. The image seeds ownership at /covers and
+      # the named volume below mounts there; keep COVER_DIR=/covers in .env.
+      COVER_DIR: ${COVER_DIR:?set COVER_DIR in .env}
       PORT: "8080"
       # Log timestamps only. Go's `log` stamps lines in local time, and this
       # service has no other use for a zone: bookmark timestamps are unix ms
@@ -80,6 +83,8 @@ services:
       # no rebuild, no restart. `git pull` restores the committed version, which
       # is why a redeploy always ships the repo's script.
       - ./userscript:/userscript:ro
+      # Content-addressed cover bytes survive API restarts and redeploys.
+      - cover-data:/covers
     # Bound to loopback only: the proxy (or curl during smoke test) reaches it,
     # the public internet does not.
     ports:
@@ -112,6 +117,7 @@ services:
 
 volumes:
   postgres-data:
+  cover-data:
   # The pre-Postgres SQLite volume (bookmarks-data) is deliberately no longer
   # declared here: undeclared means `docker compose down -v` cannot take it
   # with the rest, so the old database survives the cutover until someone