fixes: image-url proxy + raw-publish fallback on rewrite failure

1. Clean image URLs
   Article HTML was leaking the full Supabase Storage URL:
     https://supabase.onsethost.com/storage/v1/object/public/distribute-media/<uuid>/<file>
   Now rewritten on render to:
     /img/distribute-media/<uuid>/<file>
   Served by new /img/[...path] route handler that proxies to Supabase
   with 24h public cache + 7d SWR. Better SEO (first-party images) and
   stops leaking the storage host into article markup.

2. Stuck PR submissions
   When the rewrite pipeline fails (Ollama 503 / bad model output), the
   submission used to sit forever in ai_original_submissions without
   becoming a public wp_imported_posts row. PR firms got "delivered"
   status with no visible article anywhere.

   /api/ai/submit now calls publishRawFallback() if rewriteSubmission
   returns anything other than 'succeeded'. The fallback inserts a
   wp_imported_posts row containing the raw HTML body with a visible
   "Distributed as a press release — staff editorial rewrite pending"
   banner at the top, so the article surfaces immediately. A future
   retry job can swap in the rewritten content when Ollama recovers.

src/lib/legacy-image.ts

@@ -27,10 +27,18 @@ export function rewriteLegacyImageUrl(url: string | null | undefined): string {
 }
 
 export function rewriteLegacyImageUrlsInHtml(html: string): string {
-  return html.replace(
+  let out = html.replace(
     /(https?:\/\/(?:www\.)?broadcastbeat\.com\/wp-content\/uploads\/[^"'\s)]+)/g,
     (m) => rewriteLegacyImageUrl(m),
   );
+  // Rewrite raw Supabase Storage URLs to clean first-party /img/<bucket>/<path>
+  // so article HTML never leaks the long supabase.onsethost.com URL. Better for
+  // SEO and keeps images visually first-party. Served by /img/[...path]/route.ts.
+  out = out.replace(
+    /https?:\/\/(?:[\w-]+\.)*supabase\.onsethost\.com\/storage\/v1\/object\/public\/([^\s"')]+)/g,
+    (_m, p) => `/img/${p}`,
+  );
+  return out;
 }
 
 /**