Cover images were loaded via <img src> which doesn't include the
Authorization header, resulting in 401 from the Rust API. Now covers
are fetched through axios as blobs and displayed via object URLs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>