fix: check negative cache in Service.Get() before fetching upstream

The checkNegativeCache() method existed but was never called, making
negative caching (for failed fetches) completely non-functional.
Failed URLs were being re-fetched on every request.

Add negative cache check at the start of Service.Get() to short-circuit
requests for recently-failed URLs.

Fixes #3

internal/imgcache/service.go

@@ -78,8 +78,24 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 	}, nil
 }
 
+// ErrNegativeCached is returned when a URL is in the negative cache (recently failed).
+var ErrNegativeCached = errors.New("request is in negative cache (recently failed)")
+
 // Get retrieves a processed image, fetching and processing if necessary.
 func (s *Service) Get(ctx context.Context, req *ImageRequest) (*ImageResponse, error) {
+	// Check negative cache first - skip fetching for recently-failed URLs
+	negHit, err := s.cache.checkNegativeCache(ctx, req)
+	if err != nil {
+		s.log.Warn("negative cache check failed", "error", err)
+	}
+	if negHit {
+		s.log.Debug("negative cache hit",
+			"host", req.SourceHost,
+			"path", req.SourcePath,
+		)
+		return nil, fmt.Errorf("%w: %w", ErrUpstreamError, ErrNegativeCached)
+	}
+
 	// Check variant cache first (disk only, no DB)
 	result, err := s.cache.Lookup(ctx, req)
 	if err != nil {