Collect public portraits during crawls and GitHub enrichment

[ralyodio]

Ordinary crawls and GitHub enrichment previously discarded public portraits, leaving many prospects as initials even though their source pages supplied photos. This change carries those photos into the existing prospect, approval-card and digest avatar fields.

• Retain JSON-LD Person.image and explicitly named team images, including relative and lazy-loaded URLs, from pages the crawler already fetched. Reject ambiguous shared images across pages and unsafe URLs.
• Keep GitHub's public avatar during direct enrichment and enrichment of known accounts; a same-name search result cannot supply a photo without confirming an existing identity.
• Fill only missing photos after suppression checks and save source-page provenance in the same transaction. A previous paid-search miss does not prevent a later public crawl from finding a photo.
• Fall back to initials when an image cannot load. Document the free sources alongside the existing optional ValueSERP LinkedIn search.

Validation: bun run check (formatting, root typecheck and 1,544 passing tests); separate web typecheck and production build; a live anonymous GitHub lookup returned octocat's public avatar with its profile URL and zero provider cost. The crawl integration tests use local HTML fixtures and real migrated databases.

Existing people gain photos on their next crawl or enrichment. No new credentials, dependencies or database migration are required. No production backfill, merge or deployment was performed; LinkedIn continues to use the existing public search-result path.