feat: optional FlareSolverr support for proxied images

[vlnst]

Images on Stack Exchange (i.sstatic.net) are now behind a Cloudflare challenge, so /proxy received the "Just a moment..." page instead of the image and the browser showed broken images. This happens with the API scraper as well.

This adds optional support for FlareSolverr to the image proxy:

• If an image request gets a 403 and FLARESOLVERR_URL is set, the proxy asks FlareSolverr to solve the challenge once and keeps the resulting cookies and user agent per host. Later image requests reuse them, so FlareSolverr is called again only when the clearance stops working.
• Concurrent requests for the same host share one solve, including a failed one.
• Redirects to another host use that host's clearance.
• If the upstream returns anything other than 200, the proxy now responds with 502 instead of passing the challenge page through as an image.

Without FLARESOLVERR_URL, nothing changes except the 502.

Testing: ran an instance with SCRAPER=api for about 2 hours, loading a question with images every 5 minutes. 118 of 119 images loaded (the failure was a third-party host with an invalid TLS certificate). The only solves happened on startup, and the clearance cookie was still valid after 112 minutes. A solve takes about 2–3s; cached image requests had a median of 0.42s. Unit tests cover shared solves and per-host clearance.

[vlnst]

Maybe this should be done for HTML scraping as well...