Check cached sources with upstream after the cache TTL (closes #69)

Cached images were served until eviction, so upstream changes were
missed.

After 24 hours a request checks the source with upstream, sending its
stored ETag and Last-Modified. A 304 renews it with no download or
conversion. New bytes replace it; older variants are converted again.
A failed check serves the cached image and puts the URL in the
negative cache. Images not checked for 30 days are evicted.

Variant rows keep the source's ETag and Last-Modified for checking a
variant of an evicted source.

A variant file's modification time is its source's check time when it
was made or renewed. Hits read it without a database call. The ETag
includes it, so new bytes get a new ETag.

Model: opus-5-5

internal/imgcache/filestore_internal_test.go

@@ -38,15 +38,15 @@ func TestFileStore_WriteAndOpen(t *testing.T) {
 	}
 
 	// Open and verify size and content
-	r, size, err := storage.Open(key)
+	r, info, err := storage.Open(key)
 	if err != nil {
 		t.Fatalf("Open() error = %v", err)
 	}
 
 	defer func() { _ = r.Close() }()
 
-	if size != int64(len(content)) {
-		t.Errorf("Open() size = %d, want %d", size, len(content))
+	if info.Size() != int64(len(content)) {
+		t.Errorf("Open() size = %d, want %d", info.Size(), len(content))
 	}
 
 	loaded, err := io.ReadAll(r)