Document and test the one-year max-age cap (closes #63)

The README said max-age is the seconds left until the URL's expiry, but a
URL expiring more than a year away gets one year; it now says at most one
year. A new case for an encrypted URL with a two-year TTL expects
max-age=31536000.

Model: opus-5-5

internal/handlers/image_cache_control_internal_test.go

@@ -158,8 +158,9 @@ func TestHandleImage_AllowlistedHost_MaxAge(t *testing.T) {
 }
 
 // TestHandleImageEnc_MaxAge verifies that an image served through an encrypted
-// URL with a 60 second TTL may be cached for at most those 60 seconds, and that
-// one made without a TTL, which never expires, may be cached for a year.
+// URL with a 60 second TTL may be cached for at most those 60 seconds, that one
+// with a two-year TTL may be cached for a year, and that one made without a
+// TTL, which never expires, may be cached for a year.
 func TestHandleImageEnc_MaxAge(t *testing.T) {
 	t.Parallel()
 
@@ -170,6 +171,7 @@ func TestHandleImageEnc_MaxAge(t *testing.T) {
 		wantAtMost  int
 	}{
 		{"60 second TTL", time.Now().Add(time.Minute).Unix(), 50, 60},
+		{"two-year TTL", time.Now().Add(2 * 365 * 24 * time.Hour).Unix(), 31536000, 31536000},
 		{"no TTL", 0, 31536000, 31536000},
 	}