fix(photos): faster large-album loading and album cover lifecycle

Large albums opened slowly and flickered; the default album cover was
also lost in the media-objects refactor.

Large-album loading:
- quantize signed object URLs within a window and send Cache-Control so
  previews are reused instead of re-fetched
- publish photo.updated (not photo.created) when variants are ready, so
  clients update in place without reordering the grid
- worker concurrency + newest-first variant priority; raise default batch

Album cover:
- first uploaded photo becomes the cover when none is set
- clear the cover when the cover photo is trashed or moved out
- "set as album cover" in the photo context menu and actions panel

OpenSpec changes: fix-large-album-load, fix-album-cover

backend/internal/app/app.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io/fs"
 	"net/http"
 	"strings"
@@ -59,7 +60,7 @@ func New(cfg *config.Config, repos store.Repos, ping func(ctx context.Context) e
 	membersSvc := members.NewService(repos.Members, repos.Albums, hub, notifSvc)
 
 	photosSvc := photos.NewService(repos.Photos, albumsSvc, st, hub)
-	photosWorker := photos.NewWorker(photosSvc, cfg.Worker.Interval, cfg.Worker.Batch, cfg.Worker.PendingTTL)
+	photosWorker := photos.NewWorker(photosSvc, cfg.Worker.Interval, cfg.Worker.Batch, cfg.Worker.PendingTTL, cfg.Worker.Concurrency)
 
 	socialSvc := social.NewService(repos.Social, albumsSvc, repos.Photos, hub, notifSvc)
 
@@ -198,20 +199,36 @@ func (s *Server) health(c *gin.Context) {
 
 func (s *Server) serveObject(c *gin.Context) {
 	key := strings.TrimPrefix(c.Param("key"), "/")
+	// Objects are immutable (one key maps to one blob), so successful responses
+	// are safe to cache. The header is dropped on error paths below.
+	c.Writer.Header().Set("Cache-Control", cacheControlValue(s.cfg.Storage.CacheMaxAge))
 	switch err := s.storage.ServeObject(c.Writer, c.Request, key); {
 	case err == nil:
 		return
 	case errors.Is(err, storage.ErrSignedURLInvalid):
+		c.Writer.Header().Del("Cache-Control")
 		c.Status(http.StatusForbidden)
 	case errors.Is(err, storage.ErrObjectNotFound):
+		c.Writer.Header().Del("Cache-Control")
 		httpx.RespondError(c, httpx.NotFound("object_not_found", "object not found"))
 	case errors.Is(err, storage.ErrRangeNotSatisfiable):
+		c.Writer.Header().Del("Cache-Control")
 		c.Status(http.StatusRequestedRangeNotSatisfiable)
 	default:
+		c.Writer.Header().Del("Cache-Control")
 		c.Status(http.StatusInternalServerError)
 	}
 }
 
+// cacheControlValue renders the Cache-Control value for object responses.
+// Non-positive values fall back to a one-hour freshness window.
+func cacheControlValue(maxAge time.Duration) string {
+	if maxAge <= 0 {
+		maxAge = time.Hour
+	}
+	return fmt.Sprintf("private, max-age=%d", int(maxAge.Seconds()))
+}
+
 func (s *Server) albumSSE(c *gin.Context) {
 	userID := auth.UserID(c)
 	albumID := c.Param("id")