Add upstream connection info and download metrics to logging

- Capture TLS version, cipher suite, HTTP version, and remote addr
- Add download bitrate using go-humanize SI formatting
- Use consistent WxH format for dimensions (not struct notation)
- Rename input/output to src/dst for consistency
- Add separate "upstream fetched" log with connection details

internal/imgcache/fetcher.go

@@ -2,11 +2,13 @@ package imgcache
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"io"
 	"net"
 	"net/http"
+	"net/http/httptrace"
 	"strings"
 	"sync"
 	"time"
@@ -164,6 +166,18 @@ func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, erro
 	req.Header.Set("User-Agent", f.config.UserAgent)
 	req.Header.Set("Accept", strings.Join(f.config.AllowedContentTypes, ", "))
 
+	// Use httptrace to capture connection details
+	var remoteAddr string
+
+	trace := &httptrace.ClientTrace{
+		GotConn: func(info httptrace.GotConnInfo) {
+			if info.Conn != nil {
+				remoteAddr = info.Conn.RemoteAddr().String()
+			}
+		},
+	}
+	req = req.WithContext(httptrace.WithClientTrace(req.Context(), trace))
+
 	startTime := time.Now()
 
 	resp, err := f.client.Do(req)
@@ -178,10 +192,15 @@ func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, erro
 		return nil, fmt.Errorf("upstream request failed: %w", err)
 	}
 
-	// Get remote address if available
-	var remoteAddr string
-	if resp.Request != nil && resp.Request.URL != nil {
-		remoteAddr = resp.Request.Host
+	// Extract HTTP version (strip "HTTP/" prefix)
+	httpVersion := strings.TrimPrefix(resp.Proto, "HTTP/")
+
+	// Extract TLS info if available
+	var tlsVersion, tlsCipherSuite string
+
+	if resp.TLS != nil {
+		tlsVersion = tls.VersionName(resp.TLS.Version)
+		tlsCipherSuite = tls.CipherSuiteName(resp.TLS.CipherSuite)
 	}
 
 	// Check status code
@@ -216,6 +235,9 @@ func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, erro
 		StatusCode:      resp.StatusCode,
 		FetchDurationMs: fetchDuration.Milliseconds(),
 		RemoteAddr:      remoteAddr,
+		HTTPVersion:     httpVersion,
+		TLSVersion:      tlsVersion,
+		TLSCipherSuite:  tlsCipherSuite,
 	}, nil
 }