fix: social images are validated on the API, MCP, batch and import paths (WR-16)

Only the admin seoimage field refused values that are not a path or an
http(s) URL; SetURLSEO, SaveRule and SaveSettings stored javascript:,
data: or protocol-relative values, which /resolve then served as
og:image. All three now refuse them with image.url_invalid.

classes/settings_write.go

@@ -202,6 +202,9 @@ func (s *Service) SaveSettings(ctx context.Context, tx *gorm.DB, in SettingsWrit
 	oneOf("url_host", row.URLHost, models.HostKeep, models.HostWWW, models.HostBare)
 	oneOf("url_slash", row.URLSlash, models.SlashKeep, models.SlashAdd, models.SlashDrop)
 	oneOf("csv_delimiter", row.CSVDelimiter, "", ",", ";")
+	if _, sent := in.Values["default_og_image"]; sent && !ValidImageURL(row.DefaultOGImage) {
+		problems["default_og_image"] = append(problems["default_og_image"], models.Problem{Key: errImageURL})
+	}
 	for field, list := range row.Problems() {
 		problems[field] = append(problems[field], list...)
 	}