chore: audit-flagged cleanups (no behaviour change)

Four small follow-ups from the 0.9.0 audit, none of them
user-visible:

- Migration 0007 drops `chapters_manga_idx`. The 0001 schema declared
  both `UNIQUE (manga_id, number)` and `CREATE INDEX chapters_manga_idx
  ON (manga_id, number)`, but Postgres maintains an identical index
  for the unique constraint automatically — the explicit one was just
  paying for a second per-write update. Query plans are unchanged
  because the planner already preferred the constraint's index.
- `upload::parse_image` sniffs from the first 64 bytes instead of the
  full image buffer. `infer` only looks at magic bytes anyway, so
  scanning 20 MiB is wasted work. Functionally identical; cheaper in
  the hot path.
- AVIF was on the whitelist but had no test fixture. New `avif_bytes`
  helper produces a minimal `ftyp avif` header that `infer` recognises,
  and a new `accepts_avif` unit test covers the path end-to-end.
- Frontend `request()` sets `credentials: 'include'`. Same-origin
  callers see no change (default was already `'same-origin'`), but the
  first user who configures `CORS_ALLOWED_ORIGINS` for a cross-origin
  deployment gets working cookies without having to chase a runtime
  ApiError trail.

No version bump.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/upload/mod.rs

@@ -21,7 +21,11 @@ pub fn parse_image(bytes: Vec<u8>, max_size: usize, field_name: &str) -> AppResu
             "{field_name} exceeds {max_size}-byte cap"
         )));
     }
-    let kind = infer::get(&bytes).ok_or_else(|| {
+    // `infer` only looks at magic bytes in the first dozen-or-so bytes;
+    // hand it a small head slice rather than walking the whole 20-MiB
+    // image buffer when sniffing.
+    let head = &bytes[..bytes.len().min(64)];
+    let kind = infer::get(head).ok_or_else(|| {
         AppError::UnsupportedMediaType(format!("{field_name}: unrecognised image format"))
     })?;
     let (mime, ext) = match kind.mime_type() {
@@ -56,6 +60,20 @@ mod tests {
         b"%PDF-1.4\n%\xc4\xe5".to_vec()
     }
 
+    fn avif_bytes() -> Vec<u8> {
+        // Minimal `ftyp avif` header that `infer` recognises. A real
+        // AVIF would continue with `mdat`/`meta` boxes; the magic bytes
+        // alone are enough for sniffing.
+        vec![
+            0x00, 0x00, 0x00, 0x18, // box size = 24
+            b'f', b't', b'y', b'p', // box type
+            b'a', b'v', b'i', b'f', // major brand
+            0x00, 0x00, 0x00, 0x00, // minor version
+            b'm', b'i', b'f', b'1', // compatible brand
+            b'a', b'v', b'i', b'f', // compatible brand
+        ]
+    }
+
     #[test]
     fn accepts_png() {
         let img = parse_image(png_bytes(), 1024, "cover").unwrap();
@@ -70,6 +88,13 @@ mod tests {
         assert_eq!(img.ext, "jpg");
     }
 
+    #[test]
+    fn accepts_avif() {
+        let img = parse_image(avif_bytes(), 1024, "cover").unwrap();
+        assert_eq!(img.mime, "image/avif");
+        assert_eq!(img.ext, "avif");
+    }
+
     #[test]
     fn rejects_non_image_with_unsupported_media_type() {
         let err = parse_image(pdf_bytes(), 1024, "cover").unwrap_err();