Split internal/imgcache into the image proxy and the cache (closes #317)

The new package internal/imageproxy holds Proxy, which was imgcache.Service,
with its Config, ImageResponse, CacheStatus and errors. imageproxy.New makes
and registers the counters of upstream fetches and transforms.
internal/imgcache holds the cache only, with its hit and miss counters, and
imgcache.CacheConfig is imgcache.Config. The cache reads and writes each kind
it keeps with one pair of methods: Variant and PutVariant, Source and
PutSource, Failure and PutFailure. Source replaces LookupSource followed by
GetSourceContent. imgcache.go and module.go are gone. The proxy's tests moved
with it. The cache's tests check that the reconciliation pass removes an empty
or cut file and its row. The proxy's tests remove them by hand, then check
that Get fetches or converts again.

Model: opus-5-5

TODO.md

@@ -30,6 +30,37 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-26 `internal/imgcache` holds the cache only (closes #317). The new
+  package `internal/imageproxy` fetches, transforms, caches and serves images.
+  It imports `imgcache`, and `imgcache` does not import it.
+    - `imgcache.Service` is `imageproxy.Proxy`, built by `imageproxy.New` from
+      an `imageproxy.Config`.
+    - `ImageResponse`, `CacheStatus`, `ErrNegativeCached` and
+      `ErrProcessingTimedOut` moved with it, under their names.
+    - `imgcache.CacheConfig` is `imgcache.Config`.
+    - The cache has one read and one write for each kind it keeps. Each takes
+      the place of an earlier method:
+        - `Variant`, of `GetVariant`
+        - `PutVariant`, of `StoreVariant`
+        - `Source`, of `LookupSource` followed by `GetSourceContent`
+        - `PutSource`, of `StoreSource`
+        - `Failure`, of `checkNegativeCache`
+        - `PutFailure`, of `StoreNegative`
+    - `Variant` and `Source` each open the file and hand its access time to the
+      background writer. A cache hit still makes no database call.
+    - `imgcache.go` and `module.go` are gone.
+    - `imageproxy.New` makes the counters of upstream fetches and transforms,
+      and registers them on the registry it is given. The cache keeps only the
+      hit and miss counters.
+    - A cached source whose row cannot be read is logged as "failed to load
+      cached source, fetching". It was logged as "source lookup failed".
+    - The proxy's tests moved to `internal/imageproxy`. They reach the cache
+      through its database, its state directory and its metrics registry.
+    - The tests of an empty or cut cached file are split in two:
+        - `internal/imgcache` checks that the reconciliation pass removes the
+          file and its row, with a warning naming the file.
+        - `internal/imageproxy` removes the file and its row as the pass does,
+          and checks that `Get` fetches or converts again.
 - 2026-10-26 both image routes serve an image with one function, `serveImage`,
   and answer its errors with one, `respondImageError` (closes #316).
   `HandleImage` parses the path and verifies the signature, and `HandleImageEnc`