Fix Amazon product image provenance

[SteveSimonson]

Summary

• Prevent scraped Amazon recommendation images from appearing in product galleries.
• Allow multi-image galleries only for ASIN-scoped Creators API responses.
• Sanitize all 98 generated Amazon records to one primary image unless verified.
• Add unit, catalog, and browser regressions for the affected SMIRLY page.

Root cause

The HTML importer collected image URLs across the entire Amazon product document, including recommendation modules for unrelated products. The PDP then trusted every stored URL as gallery media.

Verification

• npm test — 17 passed
• npm run lint — passed
• npm run build — passed
• Playwright product-page suite — 13 passed, including all 196 PDP layouts
• Affiliate tag remains iu0e3-20
• No secrets in the diff

Deploy

• Deploy to production after adversarial review, CI, and merge

Agent gate

• Independent adversarial review — pending
• Local verification — PASS
• CI green — pending

[SteveSimonson]

ADVERSARIAL REVIEW: PASS

[SteveSimonson]

PRODUCTION DEPLOY: PASS

• Squash merge: 4891443
• Cloudflare version: aaffb339-7fe7-47ea-b945-c73e0c148bfb
• Live SMIRLY PDP primary image: 81FoZNCStHL
• Thumbnail rail: disabled (0 thumbnail buttons)
• Unrelated image tokens: absent
• Live Amazon links retain tag iu0e3-20
• Independent adversarial review and CI: PASS