perf(workers): cache social preview images

[benvinegar]

What

Cache fully pinned social-preview screenshots in Cloudflare's local edge Cache API so repeat unfurls avoid another Browser Rendering invocation.

How

• advertises preview URLs pinned by post version, workspace theme, deterministic dark mode, and renderer/package generation
• maps public v to the renderer's historical ver lookup, so nonexistent or forged revisions fail before cache access
• revalidates authentication, post existence, and revision at the board DO before every cache lookup
• stores a one-hour internal edge copy while preserving the current client policy
• keeps token-protected boards private; only configured public-read boards emit public image responses
• reapplies the current access policy after hits, including public-read → protected transitions
• bypasses caching for HEAD, nocache, unversioned, malformed, or incompletely pinned requests
• exposes x-sideshow-screenshot-cache: hit|miss for verification

This is the OSS adaptation of the cache approach proven in sideshow-cloud; it requires no R2 bucket, new binding, or prewarming.

Validation

• npm test — 476 Node tests and 4 viewer tests passed
• npm run typecheck
• npm run lint
• npm run format:check
• npm run build
• npm run test:worker
• npm run security:audit
• independent security/correctness review — no blocker, high, or medium findings

This PR description was generated by Pi using gpt-5.6-sol