fix: use /media/paintings/<code> directly for 3-letter codes
prefetchPicture did a /api/painting-code lookup first, then passed the
returned (fully-qualified) slug into .painting().by(). .by()'s URL
builder assumed the slug was a bare timestamp, so it produced
/media/paintings/auth0|.../painting/TS.png — which lith 404s on since
it tries to treat the long path as a short code.
The /media/paintings/<code>.png endpoint already resolves the slug and
user server-side, so skip the client-side lookup and hit it directly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>