fix: preserve responsive images in proxied and reading views

[marcomarcogd]

The webpage proxy rewrites src but leaves responsive image candidates in srcset pointing at the app origin. Readability can also detect the page lead image from metadata while returning article HTML with no images.

This change:

• proxies every candidate in img and source srcset / data-srcset attributes while preserving width and density descriptors;
• decodes HTML entities before resolving relative URLs and skips non-HTTP or already proxied resources;
• restores Readability's valid lead image only when the extracted article contains no image, then runs it through the existing sanitizer.

The existing media and full-text test files now cover the Next.js <picture> structure from the report, mixed-case srcSet, entity decoding, candidate descriptors, lead-image restoration, and duplicate-image protection.

Validation:

• go test -count=1 ./internal/handlers/media ./internal/handlers/core
• go vet ./...
• go build ./...
• npm run test:unit (247 tests)
• npx eslint . (0 errors; existing warnings remain)
• npm run build
• git diff --check

The full Go suite's existing macOS-only AppImage and storage migration failures reproduce unchanged on upstream/main; the affected packages and Linux CI remain the authoritative checks for this patch.

Fixes #1230

[WCY-dt]

@marcomarcogd pr 尽量不要直接往 main 里面合并，这样的话 release 管理不太好做。tools 文件夹下有个用于新版本的脚本：new-release.ps1，执行后可以创建一个新的 release 分支，所有 pr 合并进这个分支，然后攒一段时间统一发新的 release。