content-studio: complete Instagram publish E2E with public HTTPS JPEG asset (#593)

[thxforall]

Parent\n\nParent: #593\n\n## Context\n\nInstagram publish implementation for #596-#600/#599 has been pushed on branch chore/session-3-codex-harness-leftovers. Local verification on 2026-05-28 confirmed:\n\n- Meta app/tester setup is connected to decodedmag.\n- Instagram publish env is loaded by the Rust API.\n- Next proxy route is wired and returns auth errors correctly.\n- Local DB migration for content_publish_accounts / content_publish_jobs applies cleanly.\n- Publish account lazy-upsert stores token_ref = INSTAGRAM_PUBLISH_ACCESS_TOKEN, not the raw token.\n- Preflight failures persist failed publish jobs with structured error_json.stage = asset_preflight.\n\nActual Instagram publishing was not executed because local Supabase assets are not Meta-reachable public HTTPS JPEG URLs. Existing local content-studio-assets entries were PNG and/or local URLs.\n\n## What to finish\n\nMake the Content Studio marketer flow fully E2E against a real public environment:\n\n1. Configure Instagram publish secrets in the target environment.\n2. Ensure content-studio-assets produces a public HTTPS .jpg asset with Content-Type: image/jpeg for instagram_feed.\n3. Generate or select an approved instagram_feed variant in Content Studio.\n4. Publish through the UI.\n5. Confirm Meta returns a published media id and content_publish_jobs.status = published.\n6. Verify the UI shows the latest publish job and blocks duplicate publish.\n\n## Acceptance criteria\n\n- [ ] A content marketer/admin can generate an Instagram Feed variant and publishable JPEG asset from Content Studio.\n- [ ] The Publish button appears only for approved instagram_feed variants with an eligible public JPEG asset.\n- [ ] A real publish to decodedmag succeeds from the target environment.\n- [ ] content_publish_jobs stores published, container_id, published_media_id, and published_at.\n- [ ] Duplicate publish after latest published is blocked.\n- [ ] Failure cases still persist structured error_json.\n- [ ] Document exact env names and validation evidence in the PR.\n\n## Notes\n\nRequired env for Rust API:\n\n- INSTAGRAM_PUBLISH_IG_USER_ID=17841422875235885\n- INSTAGRAM_PUBLISH_ACCESS_TOKEN\n- INSTAGRAM_GRAPH_API_VERSION=v23.0\n- INSTAGRAM_PUBLISH_ACCOUNT_LABEL=decodedmag\n\nWeb proxy also requires API_BASE_URL pointing to the Rust API.\n\n## Related\n\n- #593\n- #596\n- #597\n- #598\n- #599\n- #600\n