Count interrupted misses and the upstream bytes they read (closes #56)

The miss and transform counters are written with context.WithoutCancel,
so a client disconnect or the request timeout during or after the work
no longer loses them. A failed read of the upstream body now returns
the bytes read before the error, so an over-size or cut-off body still
moves the upstream fetch counters. processFromSourceOrFetch passes the
cached source's length directly instead of through a local named
fetchBytes.

Model: opus-5-5

TODO.md

@@ -42,10 +42,11 @@ exhaustion
   plus `variant_content`) and takes their size from `Cache.UsageBytes`,
   instead of reading `request_cache` and `output_content`, which nothing
   writes; those two tables are left in the schema. A miss is counted after
-  it is served or fails, with the bytes it fetched from upstream, so
-  `upstream_fetch_count` and `upstream_fetch_bytes` move, including for a
-  fetched source that then fails the magic byte check; `transform_count`
-  counts each image the image processor transcodes.
+  it is served or fails, even when the request context has ended by then,
+  with the bytes it read from upstream, so `upstream_fetch_count` and
+  `upstream_fetch_bytes` move, including for an upstream body that fails
+  partway or a fetched source that then fails the magic byte check;
+  `transform_count` counts each image the image processor transcodes.
 - 2026-09-28 strip metadata from processed images (closes #82): every output is
   exported with govips' `StripMetadata`, so it carries no EXIF, XMP, IPTC or ICC
   profile; the image is first turned upright with `AutoRotate` (before sizes are