Read a cached source only once a processing slot is taken (closes #64)

A request whose source was in the disk cache read the whole file into
memory, then waited for a processing slot, so a burst of new sizes for
one large cached image held one copy per waiting request, with no
ceiling. The service now opens the cached file and hands it to the image
processor, which reads it only after taking its slot. The file's size,
now returned by GetSourceContent, still sends an empty or oversized
cached source to upstream instead. A cached file that fails while being
read now fails the request instead of being fetched again.

Model: opus-5-5

TODO.md

@@ -34,10 +34,11 @@ P2: security: referer blacklist
   limits the images decoded and encoded at once, and `upstream_connections`
   (default 64) the connections to all upstream hosts together, on top of
   `upstream_connections_per_host`; a fetch holds its connection until its image
-  has been processed; a request that finds either limit reached waits up to 10
-  seconds for a free one, then gets 503 `server busy, try again later`; libvips
-  runs one worker thread per image with its operation cache off; documented in
-  `README.md` and `config.example.yml`.
+  has been processed, and a request whose source is cached reads it only once it
+  has a processing slot; a request that finds either limit reached waits up to
+  10 seconds for a free one, then gets 503 `server busy, try again later`;
+  libvips runs one worker thread per image with its operation cache off;
+  documented in `README.md` and `config.example.yml`.
 - 2026-09-29 `trusted_proxies` advice and signature padding in `README.md`
   (closes #150): the login-limit paragraph, the `trusted_proxies` entry and
   `config.example.yml` say to set `trusted_proxies` to the address pixa sees for