Fix NFT page showing only Ethereum: IPFS gateway fallback, show-more, Solana wallet changes

[Tarrant64]

Problem

After #11 + #12 were deployed, the NFT page appeared to show only Ethereum NFTs.

Reproduced in a real (headless) browser against the deployed build:

• The API was fine. /nfts returned 299 Cardano NFTs, 296 of them with an image URL. Ethereum returned 31, Algorand 1.
• Every Cardano image and the Algorand image failed. Show Cardano NFT images on the NFT page; load Algorand NFTs in /next #12 points them at https://ipfs.io/ipfs/<cid>, and the public ipfs.io gateway now answers hot-linked images with a Cloudflare challenge (HTTP 403, or 429 without a browser user agent). dweb.link, w3s.link and nftstorage.link answer the same way.
• Gallery Mode hides tiles whose image fails. Of 328 tiles, only the 29 Ethereum ones (Alchemy CDN) stayed visible. The grid showed a placeholder on every Cardano card, so the only artwork on the page was Ethereum's.
• The All Chains grid stopped at 100 cards (sorted by value). Algorand and Solana NFTs, which have no floor price, could never appear there.
• Collections rendered as [object Object], and the collection count was inflated (331).
• Solana: a wallet added after the last NFT fetch stayed invisible for up to 24 h (in-memory cache) or 30 days (persistent cache). The /next Refresh button does not force a refetch.

Fix

• services/nft_display_images.py turns one metadata image URL into an ordered list of browser-safe URLs.
  • IPFS content is offered on every configured gateway. This covers ipfs://, ipfs://ipfs/, a bare CID, and any /ipfs/<cid> gateway URL, with the sub-path percent-encoded and .. rejected.
  • Other URLs pass only if they are https:// or data:image/.
  • Gateways are set with NFT_DISPLAY_IPFS_GATEWAYS. The default order is ipfs.blockfrost.dev, then Pinata, ipfs.io, dweb.link. ipfs.blockfrost.dev served the same content in under a second when this PR was made.
• /nfts (Cardano) and /nfts/algorand return image_url plus image_fallbacks.
• v2 NFT page:
  • nftImgFallback() tries the next URL before showing the placeholder or hiding the tile. This applies to the grid, Gallery Mode and the detail modal.
  • Only https:// and data:image/ URLs are ever used. This closes the raw http:// nft.image fallback noted in the Show Cardano NFT images on the NFT page; load Algorand NFTs in /next #12 review.
  • The All Chains grid has a "Show more" button instead of the hard 100-card cap.
  • Collection names come from the collection object, and the collection count is per chain.
• Solana NFT cache: stores a SHA-256 of the Solana wallet set (never the addresses) and refetches when that set changes. Legacy cache rows without the hash are refetched once.

Tests

• 36 new unit tests in tests/unit/test_nft_display_images.py: URL parsing, gateway ordering, the https-only rules, routes carrying fallbacks, Solana wallet-set invalidation and static checks of the page. One assertion in test_cardano_nft_images.py was updated for the gateway change.
• All tests use mocked HTTP, DB and cache, with synthetic CIDs and addresses and no live calls.
• Full unit suite: 511 passed, 8 failed. The same 8 fail on main, so no new failures.
• Browser check against production data, with the patched page and API output applied client-side only:
  • Cardano images load from the first gateway (60 of 60 image requests returned 200 in 30 s).
  • Gallery Mode keeps 325 of 328 tiles.
  • "Show more" reaches all 331 cards, including Algorand.
  • Collection names render correctly.

Not in this PR

• Images are still full-size originals, about 10 MB each on average. A thumbnail path, the image cache or a working NFTCDN integration would make the page much lighter.
• Ethereum, Polygon and Base could get the same wallet-set invalidation as Solana.
• The /next Refresh button could force a server-side refetch.

No Docker, compose, schema, auth or mobile/ changes.

🤖 Generated with Claude Code

[github-actions]

Overview

Image reference	tarrant64/abct:latest	tarrant64/abct:pr-16
- digest	60cf286aad6d	1d6e65e60b5c
- tag	latest	pr-16
- provenance	4f68c10
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	110 MB	126 MB (+16 MB)
- packages	285	285

Labels (5 changes)

• - 2 removed
• ± 3 changed
• 8 unchanged

 org.opencontainers.image.authors=Chris Catalano
 org.opencontainers.image.base.name=python:3.11-slim
-org.opencontainers.image.created=2026-09-29T01:04:27.039Z
-org.opencontainers.image.description=A Better Crypto Tracker
+org.opencontainers.image.description=Multi-chain cryptocurrency portfolio tracker supporting Cardano, Ethereum, Bitcoin, Solana, Polygon, and Base
 org.opencontainers.image.documentation=https://github.com/Tarrant64/abct/blob/main/README.md
 org.opencontainers.image.icon=https://raw.githubusercontent.com/Tarrant64/abct/main/frontend/static/apple-touch-icon.png
 org.opencontainers.image.licenses=MIT
-org.opencontainers.image.revision=4f68c10493f540619781490d297f71ab1c211ce8
 org.opencontainers.image.source=https://github.com/Tarrant64/abct
-org.opencontainers.image.title=abct
+org.opencontainers.image.title=ABCT - A Better Crypto Tracker
 org.opencontainers.image.url=https://github.com/Tarrant64/abct
 org.opencontainers.image.vendor=ABCT Project
-org.opencontainers.image.version=latest
+org.opencontainers.image.version=1.12.3