fix(learning): load readme images over https

.project-docs/30-worklog/tasks/20260820-direct-readme-client-a4d8e2c7.md

@@ -0,0 +1,62 @@
+# Task: Allow direct HTTPS images in Learning README
+
+## Identity
+
+- Task ID: 20260820-direct-readme-client-a4d8e2c7
+- Mode: Feature
+- Branch: codex/20260820-direct-readme-client-a4d8e2c7-direct-readme-client
+- Worktree: D:\Datas\OthersProjects\makelore-direct-readme-client-a4d8e2c7
+- Base commit: 28bfd8bc3e21a3c2aeec7ee7b859abf571f08757
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Allow Learning README Markdown image nodes to load credential-free HTTPS URLs directly.
+- Keep controlled project-media handling, cover behavior, raw-HTML suppression, external
+  link handling, and archive download boundaries unchanged.
+
+## Intent And Constraints
+
+- Follow the user's explicit replacement decision even though accepted client ADR-005
+  currently requires publish-time mirrored README media.
+- Limit HTTPS enablement to README image nodes by opting into the existing guarded
+  `ProjectImage` direct-source path; do not create a Renderer network proxy.
+- Preserve credential rejection and per-image failure isolation.
+
+## Outcome
+
+- Learning project detail now opts README images into the existing credential-free HTTPS
+  direct-loading path, including SVG and any format Electron can render.
+- Renamed the shared URL predicate from cover-specific to image-generic terminology.
+- Updated the detail-page regression to use a remote SVG URL and assert the HTTPS opt-in;
+  added direct component coverage proving the opt-in remains required.
+
+## Verification
+
+- Focused Learning tests: `5 passed` across the detail page and `ProjectImage`.
+- Full unit suite: `176` files, `2058 passed`.
+- `pnpm run typecheck`: passed.
+- `pnpm run lint:check`: passed with zero errors and six pre-existing warnings.
+- `pnpm run build:vite`: passed; existing chunk-size/dynamic-import advisories only.
+- `git diff --check`: passed.
+
+## Follow-ups
+
+- Reconcile ADR-005, Learning architecture/domain/current-state documents, the server
+  contract, and the production Learning commitment in an Integration Gate task.
+- Package and smoke the matching server/client revisions with real remote README images.
+
+## Promotion Candidates
+
+- Target: ADR-005, Learning system overview/domain/current state,
+  `docs/learning-project-catalog-server-contract.md`, and Learning commitments.
+  - Proposal: document sanitized direct HTTPS README images instead of authenticated
+    mirrored media; retain Main-owned archive download and controlled cover/media paths.
+  - Evidence: explicit user direction, focused direct-SVG rendering regressions, full
+    client tests, typecheck, lint, and production build.
+  - Future impact: Renderer image requests go directly to third-party HTTPS origins;
+    image format support and availability are provided by Electron and the origin.
+  - Semantic conflicts: reverses the mirrored-media rule in accepted ADR-005 and its
+    derivative contract and operational checklist.
+  - Human confirmation required: no; the user explicitly selected direct rendering.