Remove the code nothing in production calls (closes #312)

Service.Warm, the ImageCache interface, both GenerateSignedURL methods,
signature.ParseParams, imagerequest.ParseImagePath, four symbols of
internal/magic, the image processor's lists of supported formats,
IsEmpty and Count of the allowlist, ssrfSafeDialer, CacheStale,
ErrCacheMiss, ErrNegativeCache, ImageResponse.LastModified and the Load
methods of ContentStorage and VariantStorage had no caller outside
tests. They are gone, with the tests that tested only them.

The handlers tests sign their image URLs with generateSignedURL, a test
helper that builds the URL as the removed generator did. The SSRF dialer
tests call dialSSRFSafe with no operator blocklist, which is all
ssrfSafeDialer did. The tests of ParseImagePath and ContentStorage.Load
call ParseImageURL and LoadWithSize instead. MIMEToImageFormat,
ContentStorage.Store and CleanExpired stay, as pixa calls them.

Model: opus-5-5

internal/imgcache/service.go

@@ -24,8 +24,7 @@ import (
 	"sneak.berlin/go/pixa/internal/signature"
 )
 
-// Service implements the ImageCache interface, orchestrating cache,
-// fetcher, and processor.
+// Service orchestrates the cache, fetcher, and processor.
 type Service struct {
 	cache           *Cache
 	fetcher         httpfetcher.Fetcher
@@ -189,13 +188,6 @@ func (s *Service) Get(
 	return response, nil
 }
 
-// Warm pre-fetches and caches an image without returning it.
-func (s *Service) Warm(ctx context.Context, req *imagerequest.Request) error {
-	_, err := s.Get(ctx, req)
-
-	return err
-}
-
 // WaitForProcessing waits until no image is being processed, or until ctx
 // ends, and returns how many images were still being processed then.
 func (s *Service) WaitForProcessing(ctx context.Context) int {
@@ -229,30 +221,6 @@ func (s *Service) ValidateRequest(req *imagerequest.Request) error {
 	return s.signer.Verify(req)
 }
 
-// GenerateSignedURL generates a signed URL for the given request. The URL
-// carries q and fit next to sig and exp, so the image route verifies it for
-// the quality and fit it was signed with. An unset quality or fit is first
-// set to 85 or cover, the values the route uses when a URL has no q or fit.
-func (s *Service) GenerateSignedURL(
-	baseURL string,
-	req *imagerequest.Request,
-	ttl time.Duration,
-) (string, error) {
-	if req.Transform.Quality == 0 {
-		req.Transform.Quality = 85
-	}
-
-	if req.Transform.FitMode == "" {
-		req.Transform.FitMode = imagerequest.FitCover
-	}
-
-	// Sets the request's Expires and Signature
-	path, sig, exp := s.signer.GenerateSignedURL(req, ttl)
-
-	return fmt.Sprintf("%s%s?sig=%s&exp=%d&q=%d&fit=%s",
-		baseURL, path, sig, exp, req.Transform.Quality, req.Transform.FitMode), nil
-}
-
 // errPanicked is returned when processing a variant panicked.
 var errPanicked = errors.New("panic while processing image")