Add 'Never' expiry option for encrypted URLs

- Make ExpiresAt optional in CBOR (omitempty) for smaller tokens
- Treat ExpiresAt=0 as 'never expires' in parser
- URL-encode token with url.PathEscape() for safety
- Add 'Never' as default TTL option in generator form

internal/encurl/encurl.go

@@ -40,7 +40,7 @@ type Payload struct {
 	Format      imgcache.ImageFormat `cbor:"f,omitempty"`  // default: orig
 	Quality     int                  `cbor:"ql,omitempty"` // default: 85
 	FitMode     imgcache.FitMode     `cbor:"fm,omitempty"` // default: cover
-	ExpiresAt   int64                `cbor:"e"`            // required, Unix timestamp
+	ExpiresAt   int64                `cbor:"e,omitempty"`  // 0 = never expires
 }
 
 // Generator creates and parses encrypted URL tokens.
@@ -90,8 +90,8 @@ func (g *Generator) Parse(token string) (*Payload, error) {
 		return nil, ErrInvalidFormat
 	}
 
-	// Check expiration
-	if time.Now().Unix() > p.ExpiresAt {
+	// Check expiration (0 = never expires)
+	if p.ExpiresAt != 0 && time.Now().Unix() > p.ExpiresAt {
 		return nil, ErrExpired
 	}