Take the signature, the expiry and the URL scheme off the image request (closes #314)

The image request now holds only its source and its transform, exactly what
the variant key covers. The /v1/image/ handler checks the allowlist and
verifies the signature itself with Signer.Verify(req, sig, expires). Both
image handlers keep the URL's expiry as a local value for Cache-Control. The
image service holds no signer, allowlist or AllowHTTP, and ValidateRequest is
gone. The fetcher takes the source and builds its URL with Source.URL from its
own AllowHTTP, so no URL string is built and parsed again. chooseAutoFormat
returns the format it chooses instead of writing into the request. The signed
URL format and every route's answers are unchanged.

Model: opus-5-5

TODO.md

@@ -30,6 +30,27 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-26 the image request holds only what names the cached object (closes
+  #314): its source and its transform, which the variant key covers. The signed
+  URL format, the signing algorithm and every route's answers are unchanged.
+    - The `/v1/image/` handler checks `allowlist_hosts` and verifies the
+      signature itself, with `Signer.Verify(req, sig, expires)`.
+    - Each image handler keeps its URL's expiry as a value of its own, for
+      `Cache-Control`. `encurl`'s `Generate` takes the expiry and its `Parse`
+      returns it.
+    - The fetcher takes the source and builds its URL with `Source.URL`, over
+      http only when the fetcher's own `AllowHTTP` is set. `validateURL` takes
+      that URL, so no URL string is built and parsed again.
+    - `chooseAutoFormat` returns the format it chooses, and the handler puts it
+      into the request it parsed.
+    - The image service serves images through `Get`, and has `WaitForProcessing`
+      for shutdown.
+    - Removed:
+        - `Signature`, `Expires`, `AllowHTTP` and `SourceURL` of the image
+          request
+        - `Service.ValidateRequest`, and the service's signer, allowlist and
+          `AllowHTTP`
+        - `extractHost` of the fetcher and `urlToFSPath` of the mock fetcher
 - 2026-10-26 pixad's fx graph builds the image pipeline (closes #313).
   `database.New` now opens the database, so the parts below can read it while
   they are built; its stop hook still runs after the cache's. The cache's