fix(photos): faster large-album loading and album cover lifecycle

Large albums opened slowly and flickered; the default album cover was
also lost in the media-objects refactor.

Large-album loading:
- quantize signed object URLs within a window and send Cache-Control so
  previews are reused instead of re-fetched
- publish photo.updated (not photo.created) when variants are ready, so
  clients update in place without reordering the grid
- worker concurrency + newest-first variant priority; raise default batch

Album cover:
- first uploaded photo becomes the cover when none is set
- clear the cover when the cover photo is trashed or moved out
- "set as album cover" in the photo context menu and actions panel

OpenSpec changes: fix-large-album-load, fix-album-cover

.env.example

@@ -28,6 +28,11 @@ FS_ROOT=./data
 URL_SECRET=
 # Lifetime of signed object URLs
 OBJECT_URL_TTL=1h
+# Quantizes URL expiry so the same object keeps an identical URL within a window
+# (capped at OBJECT_URL_TTL), letting clients reuse cached previews
+OBJECT_URL_SIGN_WINDOW=10m
+# Cache-Control max-age for object responses (blobs are immutable)
+OBJECT_CACHE_MAX_AGE=1h
 
 # Auth. The token signing secret is generated on first start and stored in the
 # metadata layer (app_settings); it is not configured here.
@@ -42,9 +47,12 @@ APP_BASE_URL=http://localhost:8080
 SSE_HEARTBEAT_INTERVAL=25s
 SSE_CLIENT_BUFFER=64
 
-# Background worker (variant generation + object GC)
+# Background worker (variant generation + object GC).
+# Throughput is roughly WORKER_BATCH per WORKER_INTERVAL; WORKER_CONCURRENCY caps
+# how many of those jobs are processed in parallel (CPU-bound, scales with cores).
 WORKER_INTERVAL=5s
-WORKER_BATCH=10
+WORKER_BATCH=100
+WORKER_CONCURRENCY=4
 WORKER_PENDING_TTL=10m
 
 # Logging. LOG_LEVEL=debug adds per-request access logs and expected 4xx errors.