fix(recipe): use resources type field to identify checkpoint instead of modelVersionIds[0]

When importing a CivitAI image as a recipe, modelVersionIds[0] was blindly used as the checkpoint version ID. This array mixes checkpoints and LoRAs without ordering guarantees, causing LoRAs to be saved as the recipe checkpoint.

Fix by:
1. Removing the modelVersionIds[0] fallback in _download_remote_media
2. Parsing resources entries with type:"model" as the checkpoint
3. Adding model type validation in populate_checkpoint_from_civitai

Also add 2 tests for the new behavior and fix 3 tests whose mocks lacked the required model.type field.

tests/routes/test_recipe_routes.py

@@ -467,7 +467,10 @@ async def test_import_remote_recipe(monkeypatch, tmp_path: Path) -> None:
     class Provider:
         async def get_model_version_info(self, model_version_id):
             provider_calls.append(model_version_id)
-            return {"baseModel": "Flux Provider"}, None
+            return {
+                "baseModel": "Flux Provider",
+                "model": {"type": "Checkpoint", "name": "Flux"},
+            }, None
 
     async def fake_get_default_metadata_provider():
         return Provider()