Split internal/imgcache into the image proxy and the cache (closes #317)

The new package internal/imageproxy holds Proxy, which was imgcache.Service,
with its Config, ImageResponse, CacheStatus and errors. NewProxy makes and
registers the counters of upstream fetches and transforms. internal/imgcache
holds the cache only, with its hit and miss counters, and imgcache.CacheConfig
is imgcache.Config. The cache reads and writes each kind it keeps with one pair
of methods: Variant and PutVariant, Source and PutSource, Failure and
PutFailure. Source replaces LookupSource followed by GetSourceContent.
imgcache.go and module.go are gone. The proxy's tests moved with it. The
cache's tests check that the reconciliation pass removes an empty or cut file
and its row. The proxy's tests remove them by hand, then check that Get fetches
or converts again.

Model: opus-5-5

TODO.md

@@ -30,6 +30,37 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-26 `internal/imgcache` holds the cache only (closes #317). The new
+  package `internal/imageproxy` fetches, transforms, caches and serves images.
+  It imports `imgcache`, and `imgcache` does not import it.
+    - `imgcache.Service` is `imageproxy.Proxy`, built by `imageproxy.NewProxy`
+      from an `imageproxy.Config`.
+    - `ImageResponse`, `CacheStatus`, `ErrNegativeCached` and
+      `ErrProcessingTimedOut` moved with it, under their names.
+    - `imgcache.CacheConfig` is `imgcache.Config`.
+    - The cache has one read and one write for each kind it keeps. Each takes
+      the place of an earlier method:
+        - `Variant`, of `GetVariant`
+        - `PutVariant`, of `StoreVariant`
+        - `Source`, of `LookupSource` followed by `GetSourceContent`
+        - `PutSource`, of `StoreSource`
+        - `Failure`, of `checkNegativeCache`
+        - `PutFailure`, of `StoreNegative`
+    - `Variant` and `Source` each open the file and hand its access time to the
+      background writer. A cache hit still makes no database call.
+    - `imgcache.go` and `module.go` are gone.
+    - `NewProxy` makes the counters of upstream fetches and transforms, and
+      registers them on the registry it is given. The cache keeps only the hit
+      and miss counters.
+    - A cached source whose row cannot be read is logged as "failed to load
+      cached source, fetching". It was logged as "source lookup failed".
+    - The proxy's tests moved to `internal/imageproxy`. They reach the cache
+      through its database, its state directory and its metrics registry.
+    - The tests of an empty or cut cached file are split in two:
+        - `internal/imgcache` checks that the reconciliation pass removes the
+          file and its row, with a warning naming the file.
+        - `internal/imageproxy` removes the file and its row as the pass does,
+          and checks that `Get` fetches or converts again.
 - 2026-10-26 both image routes serve an image with one function, `serveImage`,
   and answer its errors with one, `respondImageError` (closes #316).
   `HandleImage` parses the path and verifies the signature, and `HandleImageEnc`