feat(covers): keep a local copy of request covers

tests/test_import_flow.py

@@ -1424,3 +1424,38 @@ def test_watched_series_suggests_only_new_parts(client, monkeypatch):
 
     assert client.delete(f"/api/series/{w['id']}").status_code == 200
     assert client.get("/api/series").json() == []
+
+
+def test_covers_are_fetched_once_and_kept(client, monkeypatch):
+    import httpx
+    calls = []
+
+    async def fake_get(self, url, **kwargs):
+        calls.append(url)
+        if "dead" in url:
+            raise httpx.ConnectError("gone")
+        ctype = "text/html" if "page" in url else "image/png"
+        return httpx.Response(200, headers={"content-type": ctype}, content=b"PNG",
+                              request=httpx.Request("GET", url))
+
+    monkeypatch.setattr(httpx.AsyncClient, "get", fake_get)
+    from wordarr import config
+    monkeypatch.setattr(config, "CONFIG_DIR", client.tmp_path / "config")
+    lib = client.post("/api/libraries", json={
+        "name": "Covers", "media_type": "ebook", "root_path": str(client.tmp_path)}).json()
+
+    def request(cover_url):
+        return client.post("/api/requests?allow_duplicate=true", json={
+            "library_id": lib["id"], "title": "Buch", "cover_url": cover_url}).json()["id"]
+
+    good = request("https://covers.example/a.png")
+    for _ in range(2):
+        resp = client.get(f"/api/requests/{good}/cover")
+        assert resp.status_code == 200
+        assert resp.content == b"PNG"
+        assert resp.headers["content-type"] == "image/png"
+    assert calls == ["https://covers.example/a.png"]  # the second came from disk
+    assert [p.suffix for p in (client.tmp_path / "config" / "covers").iterdir()] == [".png"]
+
+    for url in ("https://covers.example/page", "https://covers.example/dead", "", "file:///etc/passwd"):
+        assert client.get(f"/api/requests/{request(url)}/cover").status_code == 404