Export cache, eviction, upstream and transform metrics (closes #85)

New pixa_ metrics, none with labels:
- source cache hits and misses, counted once per variant made or checked
- cache usage and limit gauges; usage is set each time eviction reads it
- eviction count and bytes, from the size_bytes the deleted row returns
- upstream fetch duration histogram and fetch error counter
- transform duration histogram and an in-progress gauge, both including
  the wait for a processing slot

Removing a damaged file during reconciliation is not counted as an
eviction. README lists every metric; the metrics config comment now says
the pixa_ metrics are measured whether or not /metrics is served.

Model: opus-5-5

TODO.md

@@ -27,12 +27,5 @@ P2: security: per-origin rate limiting
 - P2: HTTP response handling
     - Last-Modified headers
 - P2: operational
-    - Prometheus metrics still missing:
-        - cache hits and misses, split into source images and variants
-        - cache size on disk and its limit
-        - evictions and the bytes they free
-        - upstream fetch duration and errors
-        - transcode duration
-        - images in processing
     - measure the 1k to 5k req/s target with `script/loadtest` on a machine not
       shared with other work