Name pixa's concepts at the start of the README's Design section (closes #321)

The Design section starts with a Concepts list. Each concept gets one
sentence, under the name the code gives it. Storage calls the
transformed images variants, and the sentences it changed for that are
shorter. Its paths end in the source key and the variant key, and it
lists the image cache's tables in the database. Architecture names
internal/providers and lists the packages that work with the concepts.
No code or test changes.

Model: opus-5-5

README.md

@@ -197,9 +197,8 @@ These terms are the names the code uses:
   `ETag`.
 - **Signed URL**: a `/v1/image/` URL whose `sig` signs its image request and its
   expiry `exp` with `signing_key`.
-- **Encrypted URL**: a `/v1/e/` URL whose token encrypts its image request, and
-  its expiry unless the URL lasts forever, with a key derived from
-  `signing_key`.
+- **Encrypted URL**: a `/v1/e/` URL whose token holds its image request and any
+  expiry, encrypted with a key derived from `signing_key`.
 - **Login session**: an encrypted cookie that keeps a browser logged in to the
   generator page for 30 days, or until a logout replaces the random value pixa
   keeps in the `logout` table (see Encrypted URLs).
@@ -930,6 +929,8 @@ See `configs/config.example.yml` for all options with defaults.
   the other parts that serve images and logins. Each setting's default is
   declared once, in `internal/config`.
 - **Packages**: these packages under `internal/` work with the concepts above:
+    - `handlers`: the routes, which read the image request from the URL, check
+      the signed or encrypted URL, and make the login session
     - `imagerequest`: the image request, with the source key and the variant key
     - `imageproxy`: the image proxy
     - `imgcache`: the image cache, which keeps its sources in one `FileStore`