fix(storage): the derived import conflated variant with directory

76590160 changed `variant_of` to return `{size}.{ext}`, but that value
was also being used as the on-disk DIRECTORY. Reads became
`.thumbnails/preview.webp/{hash}.webp`, which does not exist, so every
sidecar counted as unreadable and thumb_derived_import restored nothing.

Caught by thumb_import_check.sh on the run after the migration — the
harness earning its keep twice now, since this is the second defect it
has caught that no unit test could.

They are genuinely two strings and are now named as such: `dir_name` for
the path, `variant` for the row key. The cursor keeps using the
directory, so a run paused before the migration resumes at the same
position rather than restarting.

Also stops podman's compose-provider banner from burying the script's
output. Filtered rather than discarded, so genuine psql errors still
surface — swallowing those would turn a broken query into a silently
wrong assertion. Suppressing it at the source needs
`[engine] compose_warning_logs = false` in containers.conf, which is
per-developer config and cannot be relied on in CI.

tests/api/thumb_import_check.sh

@@ -80,8 +80,17 @@ fail() {
 # psql inside the compose container — no host psql dependency, matching
 # how spawn-db.sh probes readiness.
 sql() {
+  # Podman's docker-compose shim prints a provider banner to stderr on every
+  # invocation, which buries this script's own output. Filtered rather than
+  # discarded (`2>/dev/null`) so genuine psql errors still surface — losing
+  # those would turn a broken query into a silently wrong assertion.
+  #
+  # Suppressing it at the source needs `[engine] compose_warning_logs = false`
+  # in containers.conf, which is per-developer config and cannot be relied on
+  # in CI.
   docker compose -f "$COMPOSE_FILE" exec -T postgres-test \
-    psql -U oxicloud_test -d oxicloud_test -tAqc "$1"
+    psql -U oxicloud_test -d oxicloud_test -tAqc "$1" \
+    2> >(grep -v 'Executing external compose provider' >&2)
 }
 
 TOKEN=$(curl -sf -X POST "$base_url/api/auth/login" \