Refresh checkpoint with preview image/link fixes

CHECKPOINT-encryption.md

@@ -6,8 +6,8 @@ verified green at the moment this file was written.
 ## Where things are
 
 - Project: `/home/avi/Projects/skills/nost-feed-manager`
-- Git repo: `master` @ `03f6877` ("Sign NIP-98 auth for nostr.build image uploads"), on top of
+- Git repo: `master` @ `d677125` ("Show preview images and link cards in Compose"), on top of
-  `3e3467b` ("Add compose preview with image attachments (NIP-92 imeta)"), `17e8ace` (Profiles
+  `03f6877` (NIP-98 upload auth), `3e3467b` (compose preview + attachments), `17e8ace` (Profiles
   subtitle copy), and `8eb6685` (reveal-secret-key).
 - The working tree is **clean** — everything from this session is committed.
 - `/home/avi/Projects/nostr_backend/nostr_backendmanager.md` (old-CLI docs) has been updated
@@ -33,6 +33,16 @@ will appear (profile avatar + npub, the text, and any images), without publishin
 
 ## Commits this session (newest first)
 
+- `d677125` "Show preview images and link cards in Compose" — two fixes from GUI testing:
+  1. Remote images never rendered because the CSP was `img-src 'self' data:` — added `https:`
+     (`frontend/index.html`). Attached images and pasted image URLs now appear in the preview.
+  2. Link previews: a pasted web-page link (not a direct image URL) now fetches the page in the
+     Electron main process (`link_preview` IPC) and shows an OpenGraph/Twitter card (image, title,
+     description, site, hostname) in the preview. New `src/lib/media.ts::extractLinkUrls`,
+     `LinkPreview` type, `api.linkPreview`, `AppProvider.linkPreview`, `LinkPreviewCard` in
+     ComposeScreen, `styles.css` card styles. Publish is unchanged — link cards are a preview-only
+     feature (Nostr clients render their own link previews from the URL in the note).
+     Tests: `media.test.ts` (new), `ComposeScreen.test.tsx`, `apiMock.ts`, `fakeBackend.ts`.
 - `03f6877` "Sign NIP-98 auth for nostr.build image uploads" — fixes the attach-image flow, which
   failed with "Unauthorized, please provide a valid nip-98 token". nostr.build now requires a
   NIP-98 `Authorization` header. Backend: new `src/uploads.rs` (`nip98_authorization` signs a kind
@@ -60,13 +70,14 @@ cargo build --release # builds (rebuilt so the GUI runs the new backend)
 npm run typecheck     # clean (frontend/)
 npm run lint          # clean (pre-existing module warning only)
 npm run format:check  # clean
-npm test              # 60 passed (11 files)
+npm test              # 65 passed (12 files)
 npm run electron:build # compiles the Electron main process
+npm run build         # rebuilds the React bundle (dist/)
 ```
 
-Plus a live upload test: created a throwaway profile under `XDG_DATA_HOME=/tmp/...`, got the
+Plus live checks: a throwaway-profile `upload_auth` + `curl` upload to nostr.build returned
-`upload_auth` header through the IPC `serve` loop, and `curl`-uploaded a tiny PNG to nostr.build —
+`status: success`; the link-preview parser (same code as Electron) fetched Wikipedia's og:title +
-returned `status: success`. Temp data cleaned up.
+og:image and example.com's title correctly. Temp files cleaned up.
 
 ## How to resume