fix(photos): faster large-album loading and album cover lifecycle

Large albums opened slowly and flickered; the default album cover was
also lost in the media-objects refactor.

Large-album loading:
- quantize signed object URLs within a window and send Cache-Control so
  previews are reused instead of re-fetched
- publish photo.updated (not photo.created) when variants are ready, so
  clients update in place without reordering the grid
- worker concurrency + newest-first variant priority; raise default batch

Album cover:
- first uploaded photo becomes the cover when none is set
- clear the cover when the cover photo is trashed or moved out
- "set as album cover" in the photo context menu and actions panel

OpenSpec changes: fix-large-album-load, fix-album-cover

backend/internal/app/objects_test.go

@@ -22,7 +22,7 @@ import (
 func newTestServerWithFS(t *testing.T) (*storage.FS, *gin.Engine) {
 	t.Helper()
 	gin.SetMode(gin.TestMode)
-	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour)
+	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour, 10*time.Minute)
 	if err != nil {
 		t.Fatalf("signer: %v", err)
 	}
@@ -70,6 +70,9 @@ func TestServeObjectRoute(t *testing.T) {
 		if rec.Body.String() != "0123456789" {
 			t.Fatalf("body = %q", rec.Body.String())
 		}
+		if cc := rec.Header().Get("Cache-Control"); cc == "" || !strings.Contains(cc, "max-age=") {
+			t.Fatalf("cache-control = %q, want max-age directive", cc)
+		}
 	})
 
 	t.Run("range", func(t *testing.T) {
@@ -89,6 +92,9 @@ func TestServeObjectRoute(t *testing.T) {
 		if rec.Code != http.StatusForbidden {
 			t.Fatalf("status = %d, want 403", rec.Code)
 		}
+		if cc := rec.Header().Get("Cache-Control"); cc != "" {
+			t.Fatalf("cache-control = %q, want empty on error", cc)
+		}
 	})
 
 	t.Run("forged", func(t *testing.T) {