refactor(thumbnails): one persist_rendered for every render path

Step 10(a), the blocker. Four render paths each wrote the sidecar and
exactly one also recorded the content_derived_blobs row, so an on-demand
render — a cache miss, a size never generated, an evicted sidecar —
produced state the migration could never see. That breaks the
migration's premise rather than being untidy: thumb_derived_import would
never reach an empty tail, so the gate for deleting the sidecar would
never open.

Now every rendered thumbnail goes through persist_rendered, which owns
what persisting means. Raw `fs::write(&thumb_path, …)` drops from five
sites to two: the one inside persist_rendered, and
store_external_thumbnail's `ext-{file_id}.jpg`, which is file-keyed and
legitimately a different thing.

The path that matters most already had what it needed:
get_thumbnail_from_blob — the REST handler's fallthrough on a cache miss
— holds `dedup` and simply never used it for persistence. It now
dual-writes at no cost.

render_and_persist_all_webp had its own copy of the dual-write logic;
that copy is gone, so retiring the interim dual-write later is one edit
here rather than a hunt.

Two paths still pass `None` and remain sidecar-only: `get_thumbnail`
(renders from an on-disk original) and `generate_all_sizes_background`
(the path variant; the _from_blob sibling has dedup). Closing those
means threading a DedupService in from their callers. Left visible as an
explicit `None` at the call site rather than an absent write — the gap
is now something a reader trips over instead of something they have to
notice is missing.

Adds ThumbnailFormat::mime() beside ext(), since the derived row needs a
media type and an extension without a matching one is how a WebP ends up
labelled JPEG.

src/application/ports/thumbnail_ports.rs

@@ -94,6 +94,18 @@ impl ThumbnailFormat {
         }
     }
 
+    /// Media type, for `content_derived_blobs.content_type` and for any
+    /// response serving these bytes.
+    ///
+    /// Beside `ext` deliberately: the two must agree, and an extension
+    /// without a matching media type is how a WebP ends up labelled JPEG.
+    pub fn mime(self) -> &'static str {
+        match self {
+            ThumbnailFormat::Webp => "image/webp",
+            ThumbnailFormat::Jpeg => "image/jpeg",
+        }
+    }
+
     /// Pick the output format from a request `Accept` header: WebP when the
     /// client advertises `image/webp`, JPEG otherwise. A plain substring check
     /// is sufficient — no client sends `image/webp;q=0`, and every WebP-capable