fix(imaging): keep avatars rendering, cacheable and reliably timed

Effect renders need a little over 4s, which the 4s primary timeout cut off,
so every avatar with the default effect fell through to an unreachable
public fallback and rendered as a placeholder. Raise the primary budget
above the observed render cost and shorten the fallback budget.

Also stop the proxy from stamping no-store over the avatar and media
responses, so browsers keep the long-lived Cache-Control the route already
sends, and recreate the imaging cache directories with the container user
on every deploy, since root ownership made those cache writes fail
silently.

src/lib/proxy-access.test.ts

@@ -1,6 +1,9 @@
 // @ts-nocheck
 import { describe, expect, it } from "vitest";
-import { shouldRedirectAdminRequest } from "./proxy-access";
+import {
+	isCacheableAssetPath,
+	shouldRedirectAdminRequest,
+} from "./proxy-access";
 
 describe("shouldRedirectAdminRequest", () => {
 	it("redirects anonymous admin requests before rendering", () => {
@@ -17,3 +20,20 @@ describe("shouldRedirectAdminRequest", () => {
 		expect(shouldRedirectAdminRequest("/news", null)).toBe(false);
 	});
 });
+
+describe("isCacheableAssetPath", () => {
+	it("keeps rendered avatars and uploaded media cacheable", () => {
+		expect(isCacheableAssetPath("/api/imaging/avatar")).toBe(true);
+		expect(isCacheableAssetPath("/api/imaging/badge")).toBe(true);
+		expect(isCacheableAssetPath("/api/media/1730000000000-abc.png")).toBe(true);
+	});
+
+	it("never lets a document or API route reuse the asset cache policy", () => {
+		expect(isCacheableAssetPath("/")).toBe(false);
+		expect(isCacheableAssetPath("/news")).toBe(false);
+		expect(isCacheableAssetPath("/api/news")).toBe(false);
+		expect(isCacheableAssetPath("/api/media-library")).toBe(false);
+		expect(isCacheableAssetPath("/api/imaging")).toBe(false);
+		expect(isCacheableAssetPath("/admin/media")).toBe(false);
+	});
+});