Serve a cache hit with no database read or write (closes #309)

A hit opens the variant file and nothing else: its content type comes
from the file's first bytes, and a file in no output format is a miss
and is made again. Its access time and hit count are handed, without
waiting, to the goroutine that wrote late counts, which now writes every
count and the access times once a second; the access times wait in a
channel of 10,000 that drops the rest. checkNegativeCache leaves expired
rows to CleanExpired. The .meta files, metaCache, Lookup and golang-lru
go, with their tests; tests that read counts after Get wait for the
background write. make bench runs a parallel cache hit benchmark,
outside make check.

Model: opus-5-5

TODO.md

@@ -30,6 +30,21 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-21 a cache hit makes no database call (closes #309): `Service.Get`
+  opens the variant file with `Cache.GetVariant` and nothing else, with no
+  existence check first. The content type comes from the file's first bytes; a
+  file whose first bytes are not those of an output format, SVG included, is a
+  miss, and the variant is made again. A hit hands its access time to a channel
+  that holds up to 10,000 and drops the rest, and its hit count to the pending
+  counts, without waiting; every count is now a pending count. The goroutine
+  `StartPendingCountWrites` starts writes, once a second, the access times in
+  one transaction and the counts in one `UPDATE`; `StopPendingCountWrites`
+  writes what is left once at shutdown. `checkNegativeCache` no longer deletes
+  an expired row; `CleanExpired` in the eviction goroutine does. The `.meta`
+  files, `VariantMeta`, `LoadWithMeta`, `variantContentTypeFromSidecar`,
+  `metaCache`, `Lookup` and `golang-lru` are gone. `make bench` (`script/bench`)
+  runs `BenchmarkHandleImage_CacheHits` in the new `bench` phase of the
+  `Dockerfile`, outside `make check`.
 - 2026-10-21 a source is stored the way a variant is (closes #308): one
   `source_content` row and one file per source URL, the file named by the
   source's `SourceKey`, the SHA-256 of its host, path and query made as the