All six checks from issue #49 executed against a locally built and
running pixad (main at 6573b9d, port 18099, throwaway local config):
login form, wrong-key error, generator form after login, encrypted URL
serving an image, expired URL returning 410, and logout redirect. All
passed, as did the nine checks in scripts/manual-test.sh. Evidence
recorded as a checklist in TODO.md per its Workflow section; the cache
size management and eviction item is promoted to Next Step.
