image-proxy: one-round-trip PG image classifier primitive (replace 2 sequential queries)

Audit-mandated follow-up to MARS-558 (non-blocking, DB-lane, push-compute-to-Postgres). Today /api/image/[id] costs 2 sequential queries per profile request (práctica-miss then owner-lookup); /usuarios widened real traffic over that path. Spec: a SECURITY-INVOKER fn/view taking an image id, returning in ONE round trip {kind: clinical|profile|none, ownerUserId, practicaStudentUserId, comisionId}, clinical classification taking precedence when an id matches both. Node route becomes one call + branch, no Node-side relational workflow. db-mars-cc owns; coder-mars-cc repoints the route.