Feat: Ask Brave for 100 results and allow ?i= up to 40 on the main site

free.* and ai.* stay at 20, since Openverse and Wikimedia return ~50 results together.
Also note that production's Openverse requests are authenticated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

functions/_utils/brave.js

@@ -1,7 +1,7 @@
 // { urls } ([] if none found), or { error } if Brave refused or failed, e.g. once our rate or spending limit is hit
 export async function braveImageSearch(query, apiKey) {
   try {
-    const res = await fetch(`https://api.search.brave.com/res/v1/images/search?q=${encodeURIComponent(query)}&count=50&safesearch=off`, {
+    const res = await fetch(`https://api.search.brave.com/res/v1/images/search?q=${encodeURIComponent(query)}&count=100&safesearch=off`, {
       headers: { "Accept": "application/json", "X-Subscription-Token": apiKey },
     });
     if (!res.ok) return { error: `HTTP ${res.status}: ${(await res.text()).slice(0, 300)}` };

functions/_utils/openverse.js

@@ -2,7 +2,8 @@ const API = "https://api.openverse.org/v1";
 // Uppercase so it can't collide with query cache keys, which are always lowercased
 const TOKEN_KEY = "OPENVERSE_TOKEN";
 
-// Tokens expire (~12h); client ID/secret are permanent, so fetch a new token whenever the cached one is gone
+// Tokens expire (~12h); client ID/secret are permanent, so fetch a new token whenever the cached one is gone.
+// Production has OPENVERSE_CLIENT_ID/SECRET set, so its requests are authenticated.
 async function getToken(env) {
   if (!env.OPENVERSE_CLIENT_ID || !env.OPENVERSE_CLIENT_SECRET) return null;
   const cached = await env.DIRECT_IMG_CACHE.get(TOKEN_KEY);