fix(photos): faster large-album loading and album cover lifecycle

Large albums opened slowly and flickered; the default album cover was
also lost in the media-objects refactor.

Large-album loading:
- quantize signed object URLs within a window and send Cache-Control so
  previews are reused instead of re-fetched
- publish photo.updated (not photo.created) when variants are ready, so
  clients update in place without reordering the grid
- worker concurrency + newest-first variant priority; raise default batch

Album cover:
- first uploaded photo becomes the cover when none is set
- clear the cover when the cover photo is trashed or moved out
- "set as album cover" in the photo context menu and actions panel

OpenSpec changes: fix-large-album-load, fix-album-cover

backend/internal/app/app.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io/fs"
 	"net/http"
 	"strings"
@@ -59,7 +60,7 @@ func New(cfg *config.Config, repos store.Repos, ping func(ctx context.Context) e
 	membersSvc := members.NewService(repos.Members, repos.Albums, hub, notifSvc)
 
 	photosSvc := photos.NewService(repos.Photos, albumsSvc, st, hub)
-	photosWorker := photos.NewWorker(photosSvc, cfg.Worker.Interval, cfg.Worker.Batch, cfg.Worker.PendingTTL)
+	photosWorker := photos.NewWorker(photosSvc, cfg.Worker.Interval, cfg.Worker.Batch, cfg.Worker.PendingTTL, cfg.Worker.Concurrency)
 
 	socialSvc := social.NewService(repos.Social, albumsSvc, repos.Photos, hub, notifSvc)
 
@@ -198,20 +199,36 @@ func (s *Server) health(c *gin.Context) {
 
 func (s *Server) serveObject(c *gin.Context) {
 	key := strings.TrimPrefix(c.Param("key"), "/")
+	// Objects are immutable (one key maps to one blob), so successful responses
+	// are safe to cache. The header is dropped on error paths below.
+	c.Writer.Header().Set("Cache-Control", cacheControlValue(s.cfg.Storage.CacheMaxAge))
 	switch err := s.storage.ServeObject(c.Writer, c.Request, key); {
 	case err == nil:
 		return
 	case errors.Is(err, storage.ErrSignedURLInvalid):
+		c.Writer.Header().Del("Cache-Control")
 		c.Status(http.StatusForbidden)
 	case errors.Is(err, storage.ErrObjectNotFound):
+		c.Writer.Header().Del("Cache-Control")
 		httpx.RespondError(c, httpx.NotFound("object_not_found", "object not found"))
 	case errors.Is(err, storage.ErrRangeNotSatisfiable):
+		c.Writer.Header().Del("Cache-Control")
 		c.Status(http.StatusRequestedRangeNotSatisfiable)
 	default:
+		c.Writer.Header().Del("Cache-Control")
 		c.Status(http.StatusInternalServerError)
 	}
 }
 
+// cacheControlValue renders the Cache-Control value for object responses.
+// Non-positive values fall back to a one-hour freshness window.
+func cacheControlValue(maxAge time.Duration) string {
+	if maxAge <= 0 {
+		maxAge = time.Hour
+	}
+	return fmt.Sprintf("private, max-age=%d", int(maxAge.Seconds()))
+}
+
 func (s *Server) albumSSE(c *gin.Context) {
 	userID := auth.UserID(c)
 	albumID := c.Param("id")

backend/internal/app/health_test.go

@@ -16,7 +16,7 @@ import (
 
 func mustSigner(t *testing.T) *storage.Signer {
 	t.Helper()
-	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour)
+	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Fatalf("signer: %v", err)
 	}

backend/internal/app/objects_test.go

@@ -22,7 +22,7 @@ import (
 func newTestServerWithFS(t *testing.T) (*storage.FS, *gin.Engine) {
 	t.Helper()
 	gin.SetMode(gin.TestMode)
-	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour)
+	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Fatalf("signer: %v", err)
 	}
@@ -70,6 +70,9 @@ func TestServeObjectRoute(t *testing.T) {
 		if rec.Body.String() != "0123456789" {
 			t.Fatalf("body = %q", rec.Body.String())
 		}
+		if cc := rec.Header().Get("Cache-Control"); cc == "" || !strings.Contains(cc, "max-age=") {
+			t.Fatalf("cache-control = %q, want max-age directive", cc)
+		}
 	})
 
 	t.Run("range", func(t *testing.T) {
@@ -89,6 +92,9 @@ func TestServeObjectRoute(t *testing.T) {
 		if rec.Code != http.StatusForbidden {
 			t.Fatalf("status = %d, want 403", rec.Code)
 		}
+		if cc := rec.Header().Get("Cache-Control"); cc != "" {
+			t.Fatalf("cache-control = %q, want empty on error", cc)
+		}
 	})
 
 	t.Run("forged", func(t *testing.T) {

backend/internal/app/share_flow_test.go

@@ -149,7 +149,7 @@ func runShareFlow(t *testing.T, backend storage.Backend, verify func(t *testing.
 }
 
 func TestShareFlowWithFS(t *testing.T) {
-	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour)
+	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Fatalf("signer: %v", err)
 	}
@@ -178,7 +178,7 @@ func TestShareFlowWithS3(t *testing.T) {
 	if endpoint == "" {
 		t.Skip("S3_ENDPOINT not set")
 	}
-	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour)
+	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Skipf("signer init: %v", err)
 	}