[iamwavecut]

Problem

VIP image edit jobs stored Telegram file URLs (https://api.telegram.org/file/bot<token>/…) in taskman_jobs.record, and the same URLs went into Discovery job bodies for draw-api. Prod had 31 such records (2026-10-19…10-21).

Change

• ImageJobData gets image_file_ids (skipped when empty, so other job records keep their shape). The edit resolver stores the pictures' Telegram file IDs and only checks with getFile that each one is downloadable; it no longer builds file URLs and no longer needs the bot token.
• TelegramPictureBytesEditor wraps the VIP editor: when a request names Telegram pictures (file IDs, or Telegram file URLs from jobs queued before this change), it loads them once on the bot side and passes base64 bytes on. draw-api then receives image_b64 instead of a URL. The prompt optimizer reuses the same bytes.
• Migration 211 removes the token from the Telegram file URLs already stored in taskman_jobs (bot<token>/ → bot<redacted>/). The down migration is a no-op: the scrub is one-way by design. A queued job with a redacted URL still loads, because the loader uses the file path after the token.

Migration compatibility

• Up: rewrites only the token part of stored Telegram file URLs, in taskman_jobs rows that contain one (31 on prod). Job shape, status and timestamps stay the same.
• Down: no-op, irreversible by design; the token must not come back. Code before this change still runs against scrubbed rows: completed jobs are not re-read for their URLs, and a queued job would fail to download its picture (no such jobs on prod now).
• Old records without image_file_ids still deserialize (the field defaults to empty), so a rollback of the code and a forward deploy are both compatible with the stored jobs.

Verification

• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings: clean.
• cargo test --no-fail-fast -p openplotva-app -p openplotva-taskman -p openplotva-storage: 1438 + 179 + 68 passed.
• New tests: file IDs reach the editor as bytes; stored Telegram URLs (redacted form) reach it as bytes; non-Telegram pictures pass through without a load; a failed load fails the edit; the taskman record keeps file IDs and has no image_urls.
• Migration 211 transform, dry run in a read-only transaction on prod data: 31 rows match, 0 still contain a token after the transform, 31 remain valid JSONB.

[github-actions]

	Warnings
⚠️	Migration changes should explain forward/down compatibility, rollback/no-op behavior, or why rollback is impossible.

	Messages
📖	Danger checked 8 changed file(s).

Generated by 🚫 dangerJS against e5b39ed

[iamwavecut]

Danger warning on migration notes: added a "Migration compatibility" section to the PR body (up rewrites only the token part; down is a no-op, irreversible by design; old and new records both deserialize). The SQLx/storage check is in Verification: cargo test -p openplotva-storage and a read-only dry run of the migration transform on prod data.