fix(media): restore small-file fallback and notify user on HTTP 4xx

- Restore ≤1MB raw-byte fallback when resize_and_compress fails after
  validate_image_response passes. The body is confirmed valid by magic-byte
  check, so forwarding original bytes is safe. Prevents regression for
  formats the image crate can detect but not fully decode (e.g. animated WebP).

- Add HttpStatus 4xx match arm in Slack handler to push filename into
  failed_image_files. HTTP 4xx (401/403) indicates a persistent permission
  problem (similar root cause to #776) and the user should be notified.
  5xx and Network errors remain log-only (transient).

Author: CHC-Agent

src/media.rs

@@ -272,13 +272,18 @@ pub async fn download_and_encode_image(
     let (output_bytes, output_mime) = match resize_and_compress(&bytes) {
         Ok(result) => result,
         Err(e) => {
-            error!(
-                filename,
-                error = %e,
-                size = bytes.len(),
-                "resize failed after successful validation"
-            );
-            return Err(MediaFetchError::ProcessingFailed(e));
+            if bytes.len() <= 1024 * 1024 {
+                debug!(filename, error = %e, "resize failed, using validated original");
+                (bytes.to_vec(), mime.to_string())
+            } else {
+                error!(
+                    filename,
+                    error = %e,
+                    size = bytes.len(),
+                    "resize failed after successful validation"
+                );
+                return Err(MediaFetchError::ProcessingFailed(e));
+            }
         }
     };
 

src/slack.rs

@@ -1066,6 +1066,12 @@ async fn handle_message(
                         warn!(filename, error = %e, "image post-processing failed");
                         failed_image_files.push(filename.to_string());
                     }
+                    Err(media::MediaFetchError::HttpStatus(status))
+                        if status.is_client_error() =>
+                    {
+                        warn!(filename, %status, "image download denied");
+                        failed_image_files.push(filename.to_string());
+                    }
                     Err(e) => {
                         warn!(filename, error = %e, "image download failed");
                     }