Fix cache-miss stalls and move cache cleanup out of request path [minor]

[joecorall]

• Coalesce auth-probed local URL fallback misses so concurrent requests share upstream metadata/open work instead of stampeding Drupal.
• Reuse HTTP source transports instead of creating a fresh transport per request.
• Move the libvips concurrency limiter so source fetch/spooling does not occupy transform slots.
• Remove request-path filesystem cache eviction and add triplet-cache-cleanup.
• Have cleanup remove derivative entries older than cache.max_age, then report and exit non-zero if derivative or source caches remain over configured max bytes.
• Update Docker/build output, example config, and caching docs to include periodic cleanup guidance.

Local benchmark

make benchmark-iiif

Mode	Concurrency	Triplet OK	Duration s	Req/s	p95 ms	p99 ms	CPU ms/req	Max MiB
uncached	2	270/270 (100%)	19.02	14.2	158.0	279.8	65.96	159.3
uncached	4	270/270 (100%)	9.88	27.3	181.0	369.5	41.24	249.6
uncached	8	270/270 (100%)	7.18	37.6	280.1	480.2	56.60	289.5
cached	8	270/270 (100%)	4.22	64.0	14.6	30.9	1.69	106.6
cached	32	270/270 (100%)	3.75	72.0	17.6	34.5	1.65	147.1
cached	128	270/270 (100%)	3.90	69.2	16.0	38.3	1.49	163.8

[github-actions]

Benchmark Matrix: pr-35-25317089326

Summary

Triplet image: ghcr.io/libops/triplet:fixcache-auth-fallback-hangs

Mode	Concurrency	Triplet OK	Duration s	Req/s	p95 ms	p99 ms	CPU ms/req	Max MiB
uncached	2	270/270 (100%)	15.76	17.1	199.2	354.3	96.29	242.2
uncached	4	270/270 (100%)	12.26	22.0	330.7	587.6	101.35	363.2
uncached	8	270/270 (100%)	12.31	21.9	497.6	759.5	100.49	325.4
cached	8	270/270 (100%)	12.26	22.0	510.2	810.0	101.92	382.1
cached	32	270/270 (100%)	12.73	21.2	841.0	1014.9	92.63	299.2
cached	128	270/270 (100%)	12.87	21.0	1447.0	1816.9	67.85	302.2

Status reflects Triplet request success. Performance metrics are informational.