Serve a cache hit with no database read or write (closes #309)

A hit opens the variant file and nothing else: its content type comes
from the file's first bytes, and a file in no output format is a miss
and is made again. Its access time and hit count are handed, without
waiting, to the goroutine that wrote late counts, which now writes every
count and the access times once a second; the access times wait in a
channel of 10,000 that drops the rest. checkNegativeCache leaves expired
rows to CleanExpired. The .meta files, metaCache, Lookup and golang-lru
go, with their tests; tests that read counts after Get wait for the
background write. make bench runs a parallel cache hit benchmark,
outside make check.

Model: opus-5-5

Dockerfile

@@ -59,9 +59,28 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     { echo "--- Rerunning with -v for details ---"; \
       go test -count=1 -timeout 90s -race -parallel 4 -v ./...; exit 1; }
 
-# Build stage. Nothing is wanted from the two phases above: these copies
-# make BuildKit build them first, so nothing after them runs unless lint
-# and test passed.
+# Benchmark phase. script/bench builds it alone; no other stage copies from
+# it, so script/check and the image build never run it. It is set up as the
+# test phase is, and runs the benchmarks only, without -race.
+# golang:1.25.4-trixie, 2026-10-15
+FROM golang@sha256:a02d35efc036053fdf0da8c15919276bf777a80cbfda6a35c5e9f087e652adfc AS bench
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends libvips-dev libheif-plugin-aomenc \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+ARG CACHEBUST
+COPY . .
+
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    go test -count=1 -run '^$' -bench . ./internal/handlers
+
+# Build stage. Nothing is wanted from the lint and test phases above: these
+# copies make BuildKit build them first, so nothing after them runs unless
+# lint and test passed.
 # golang:1.25.4-alpine3.22, 2026-02-25; the runtime stage uses Alpine 3.22 too
 FROM golang:1.25.4-alpine3.22@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS builder