Fix image proxy stale refresh coordination

[stef-k]

Summary

• Serves local proxied image cache entries immediately when they are fresh or stale, and stops deleting expired-but-present image files on the user-facing read path.
• Preserves stale bytes and metadata when refresh attempts fail, and writes refreshed bytes through a sibling temp/replacement path so readers see either the previous complete file or the refreshed complete file.
• Coalesces origin fetch/refresh work by image cache key before download and ImageSharp optimization, with a process-wide origin/ImageSharp concurrency budget so duplicate requests do not multiply expensive upstream work.
• Moves anonymous proxy-image rate limiting behind local cache lookup: fresh/stale local hits bypass the anonymous proxy-image rate limit, while misses and origin work remain protected.
• Cleans up proxied cover fallback paths so public cover/thumbnail rendering uses the proxy instead of raw external cover URLs where covered by Improve image proxy cache coordination and stale image serving #317.

Closes #317.

Related follow-up: #319 tracks TripExportService raw cover URL behavior.

Validation

• Focused image/proxy/controller filter passed, 123/123.
• dotnet test passed, 1574/1574.
• dotnet run --project tools/Wayfarer.LocCheck -- --warn 400 --fail 600 passed with warnings only, no hard failures.
• git diff --check main...HEAD passed.

Manual Validation Gap

• No browser/manual trip image cache timing verification was run.