Remove runtime nil checks for always-initialized components

Since signing_key is now required at config load time, sessMgr, encGen,
and signer are always initialized. Remove unnecessary nil checks that
were runtime failure paths that can no longer be reached.

- handlers.go: Remove conditional init, always create sessMgr/encGen
- auth.go: Remove nil checks for sessMgr
- imageenc.go: Remove nil check for encGen
- service.go: Require signing_key in NewService, remove signer nil checks
- Update tests to provide signing_key

internal/imgcache/service.go

@@ -45,6 +45,10 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 		return nil, errors.New("cache is required")
 	}
 
+	if cfg.SigningKey == "" {
+		return nil, errors.New("signing key is required")
+	}
+
 	// Use custom fetcher if provided, otherwise create HTTP fetcher
 	var fetcher Fetcher
 	if cfg.Fetcher != nil {
@@ -57,10 +61,7 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 		fetcher = NewHTTPFetcher(fetcherCfg)
 	}
 
-	var signer *Signer
-	if cfg.SigningKey != "" {
-		signer = NewSigner(cfg.SigningKey)
-	}
+	signer := NewSigner(cfg.SigningKey)
 
 	log := cfg.Logger
 	if log == nil {
@@ -269,11 +270,7 @@ func (s *Service) ValidateRequest(req *ImageRequest) error {
 		return nil
 	}
 
-	// Signature required
-	if s.signer == nil {
-		return errors.New("signing key not configured but host not whitelisted")
-	}
-
+	// Signature required for non-whitelisted hosts
 	return s.signer.Verify(req)
 }
 
@@ -283,10 +280,6 @@ func (s *Service) GenerateSignedURL(
 	req *ImageRequest,
 	ttl time.Duration,
 ) (string, error) {
-	if s.signer == nil {
-		return "", errors.New("signing key not configured")
-	}
-
 	path, sig, exp := s.signer.GenerateSignedURL(req, ttl)
 
 	return fmt.Sprintf("%s%s?sig=%s&exp=%d", baseURL, path, sig, exp), nil