A look picture asked for without its version answers 304 when unchanged, behind the same access check #3745

GET /:owner/:name/looks/:env/:commit/:kind.png (lookImage in src/web/pages/looks.ts) answers private, no-cache when it is asked for a picture without its ?v= version, but it sends no validator. Every revalidation of a thumbnail therefore downloads the whole image again, and pages that show many thumbnails pay for that on every visit.

Done:

• [ ] Every successful answer carries ETag: \"<lookVersion(look)>\".
• [ ] A request whose If-None-Match matches answers 304 with no body. The cache-control header and the who-may-fetch check (mayFetchLook) run before it, exactly as they do for a 200.
• [ ] A retake at the same commit changes the ETag, so the old image is never served as current.
• [ ] A versioned (?v=) answer is still private, max-age=31536000, immutable.
• [ ] test/looks.test.ts covers four cases: a 200 with an ETag, a 304 on a match, a 200 after a retake, and a 404 for someone not allowed to fetch it even with a matching If-None-Match. Each case fails without the change.

Files: src/web/pages/looks.ts, test/looks.test.ts. Risk: a 304 must never be answered before the access check, or it would tell someone a private picture exists.