Run the reconciliation pass at startup and once a day (closes #250)

The pass makes a database query for every cached file and ran on every
eviction tick, so on a large cache one pass could outlast the tick and
the next started at once. It now runs on a timer of its own that starts
when a pass ends, a day long. Eviction and the removal of expired
negative cache rows keep the eviction interval.

Model: opus-5-5

TODO.md

@@ -30,6 +30,16 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-15 the reconciliation pass runs at startup and then once a day (closes
+  #250): it ran on every eviction tick, every 5 minutes in pixad, and makes a
+  database query for every cached file, on the one connection requests also use.
+  On a large cache a pass could take longer than 5 minutes, and the next one
+  then started at once, so the passes never stopped. The next pass now starts a
+  day after the previous one ends, so passes never run back to back. Eviction
+  and the removal of expired negative cache rows keep their 5-minute tick, and
+  eviction also runs after each reconciliation pass. A variant file whose
+  database row failed to be written is now counted in the cache size up to about
+  a day later, rather than 5 minutes.
 - 2026-10-15 the canonical files are re-vendored from `sneak/prompts` commit
   `e3f79c4` (closes #221): `.dockerignore`, `.editorconfig`,
   `.gitea/workflows/check.yml`, `.gitignore`, `.golangci.yml`,
@@ -81,13 +91,13 @@ P2: security: per-origin rate limiting
   each transformed image's `.meta` file, are synced to disk before they are
   renamed into place, and their directory after; the `.meta` file is written
   before the image, and a failed directory sync removes the renamed file. The
-  reconciliation pass, at startup and every five minutes, removes a cached
-  source or transformed image whose file is empty, or not the size the database
-  records for it, with its rows and a warning naming the file, so the next
-  request fetches the source or converts the image again; requests compare no
-  sizes. Storing a source over a file of another size replaces that file. A
-  source that fails to decode is not removed for that alone: a damaged upstream
-  image would then be fetched on every request.
+  reconciliation pass, at startup and once a day, removes a cached source or
+  transformed image whose file is empty, or not the size the database records
+  for it, with its rows and a warning naming the file, so the next request
+  fetches the source or converts the image again; requests compare no sizes.
+  Storing a source over a file of another size replaces that file. A source that
+  fails to decode is not removed for that alone: a damaged upstream image would
+  then be fetched on every request.
 - 2026-10-15 a transcode stops once its request's `downstream_timeout` has
   ended, unless it has begun encoding (closes #243): the image processor looked
   at its context only while it waited for a processing slot, so an image was