perf(*): bound list queries, batch fetches, harden media downloads

frontend/src/lib/api/stories.ts

@@ -3,10 +3,27 @@ import { auth } from "$lib/stores/auth.svelte";
 
 const BASE = import.meta.env.VITE_API_BASE ?? "/api";
 
+const MAX_CACHED = 100;
+
 const ready = new Map<string, string>();
 const missing = new Set<string>();
 const inflight = new Map<string, Promise<string | null>>();
 
+function remember(key: string, url: string) {
+  ready.set(key, url);
+  while (ready.size > MAX_CACHED) {
+    const oldest = ready.keys().next();
+    if (oldest.done) {
+      return;
+    }
+    const stale = ready.get(oldest.value);
+    ready.delete(oldest.value);
+    if (stale) {
+      URL.revokeObjectURL(stale);
+    }
+  }
+}
+
 function authHeaders(): Record<string, string> {
   return auth.token ? { Authorization: `Bearer ${auth.token}` } : {};
 }
@@ -21,7 +38,7 @@ async function fetchStoryMedia(
   const response = await fetch(url, { headers: authHeaders() });
   if (response.ok) {
     const objectUrl = URL.createObjectURL(await response.blob());
-    ready.set(key, objectUrl);
+    remember(key, objectUrl);
     return objectUrl;
   }
   missing.add(key);