A preview's look picture names its Server-Timing phases: session, look, read #5384

GET /:owner/:name/looks/:env/:commit/:kind.png now names three Server-Timing phases, so a slow look picture says whether finding the look or reading the file was slow.

• session: lookImage in src/web/pages/looks.ts notes it first, with notePhase(…, takeSessionTime(…)).
• look: this phase covers getAppByRepo, looksForEnv and mayFetchLook. loadRepo stays outside it, before the phase starts.
• read: this phase covers the existsSync check only. Bun.file(path) is lazy, so the bytes are streamed after the handler returns and fall outside any phase.
• Unchanged: the 404 conditions, etag, cache-control, 304 and content type. looks.test.ts still passes apart from the two failures below.
• Test: test/look-image-timing.test.ts records one thumb look for a public app and fetches it as the signed-in owner. The owner is needed because an anonymous reader gets 404 for that look. It asserts app, session, look and read on a 200. It passes with the change and fails with the src change stashed.
• Checks run: tsc --noEmit is clean.
• Not run: I ran only the new test and test/looks.test.ts, not the full suite.
• Failing locally: two chromium capture tests in looks.test.ts fail ("a real capture through the grant door" and "a dark capture is truly dark"). I did not check why or run them on main, so I can't say whether they predate this change. They need a real browser, which the sandbox may not allow.

To try it, request any look picture and read the server-timing response header.

Closes #5371

GET /:owner/:name/looks/:env/:commit/:kind.png now names three Server-Timing phases, so a slow look picture says whether finding the look or reading the file was slow.

• session: lookImage in src/web/pages/looks.ts notes it first, with notePhase(…, takeSessionTime(…)).
• look: this phase covers getAppByRepo, looksForEnv and mayFetchLook. loadRepo stays outside it, before the phase starts.
• read: this phase covers the existsSync check only. Bun.file(path) is lazy, so the bytes are streamed after the handler returns and fall outside any phase.
• Unchanged: the 404 conditions, etag, cache-control, 304 and content type. looks.test.ts still passes apart from the two failures below.
• Test: test/look-image-timing.test.ts records one thumb look for a public app and fetches it as the signed-in owner. The owner is needed because an anonymous reader gets 404 for that look. It asserts app, session, look and read on a 200. It passes with the change and fails with the src change stashed.
• Checks run: tsc --noEmit is clean.
• Not run: I ran only the new test and test/looks.test.ts, not the full suite.
• Failing locally: two chromium capture tests in looks.test.ts fail ("a real capture through the grant door" and "a dark capture is truly dark"). I did not check why or run them on main, so I can't say whether they predate this change. They need a real browser, which the sandbox may not allow.

To try it, request any look picture and read the server-timing response header.