Validate decoded photo size and require a photos row to serve

decodePhoto checked the GIF logical screen size, but gif.Decode returns
the first frame, which may be smaller; a 400x400 screen with a 1x1 first
frame passed and was scaled. The short-side check now measures the
decoded image's bounds. The pixel cap still comes from the header, before
decoding.

OpenPhoto served any file whose name was a canonical ULID and stored
size, with no photos row required. It now looks the id up with the new
GetPhoto query and reports an id with no row as fs.ErrNotExist, so
GET /media/photos/{id}-{size}.jpg is 404 for it even when a file exists.
OpenPhoto takes the request context for the lookup.

The media test fixture records a photos row for its served photo and
adds an orphan photo whose files exist without a row; both its sizes
must be 404.

Maestro task: 8a432108-d3ba-4013-ae8c-11963981d641

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -141,7 +141,8 @@ automatic** (D-021).
   `X-MealQuest-CSRF` header.
 - `/auth/*` — the OIDC flow.
 - `/media/*` — cached photos, behind the session cookie.
-  `GET /media/photos/{id}-{400|1200}.jpg` serves a stored size with
+  `GET /media/photos/{id}-{400|1200}.jpg` serves a stored size of a photo
+  with a `photos` row, with
   `Cache-Control: private, max-age=31536000, immutable`; anything else is
   404.
 - `/health` — liveness.
@@ -269,8 +270,8 @@ automatic** (D-021).
 - Photos are cached locally (`photos`) and processed with
   `golang.org/x/image`. `recipes.PhotoCache.CachePhoto` downloads through
   the Fetcher's `FetchImage` (JPEG, PNG, WebP or GIF content types, 8 MB
-  cap, not cached), decodes the image (a GIF's first frame), refuses one
-  under 300 px on its short side, scales it so its long side is 1200 px and
+  cap, not cached), decodes the image (a GIF's first frame), refuses a
+  decoded image under 300 px on its short side, scales it so its long side is 1200 px and
   400 px, and stores each as JPEG quality 82 at
   `$MEALQUEST_DATA_DIR/media/photos/{id}-{size}.jpg`. Images are
   deduplicated by the SHA-256 of the downloaded bytes.