fix(images): make "Save image as" work for local images and refuse honestly for remote ones

[PathGao]

4 / 5 of a stack. Base: #407.

The defect

The remote branch fetched the bytes with fetch(src) — and connect-src 'self' refuses every cross-origin fetch, so that branch was unreachable on every platform, not merely failing. (img-src allowing https: only affects <img> loading, not fetch.)

Windows fell into that same unreachable branch for local images too: the local test was src.startsWith('asset:'), while Windows asset URLs are http://asset.localhost/….

The fix reuses #363

normalizeAssetPath handles both URL shapes and — the part a hand-rolled prefix test gets wrong — rejects http://asset.localhost.evil.test/C:/secret.png, which startsWith('http://asset.localhost') accepts and would have handed to copy_file. That hole is real in the original implementation; the test asserts it.

The dead fetch path is deleted. The remote case now bails before opening a save dialog it cannot honour, and says why, rather than leaving code that reads like a feature. Supporting it needs a download command in Rust — out of scope here.

save_file_binary is now unreferenced from the frontend; left registered in Rust.

Tests

scripts/saveImageAsAssetUrl.test.ts, including a pin on "connect-src": "'self'" so the explanation in the source cannot go stale silently.

vs #407	3 red / 3 green → 6 / 6

npm run check   0 errors
npm test        458 / 458
cargo test      131 / 131

Not covered

• data: image sources — decodable in pure JS, but scope creep.
• The context-menu item is still offered for remote images; it now explains itself instead of being hidden.

🤖 Generated with Claude Code