Unsplash picks are now hotlinked, not re-hosted. Unsplash's API terms require
hotlinking the image URLs they return (copying the file to our own Storage breaks their
view/download tracking and isn't allowed), so a picked Unsplash photo now points the card
straight at images.unsplash.com and registers the use via the download endpoint. The
pick route validates the URL is a genuine Unsplash CDN host before hotlinking. Pexels,
Pixabay, and Openverse still download + host in the cards bucket, which their terms
permit. Attribution (photographer → profile, "on Unsplash" → photo page, both with UTM)
was already in place and is unchanged.
