Document durable private image delivery and bounded revocation

[kvz]

Why

A page can outlive its first direct CDN signature. Authorized redirects already solve that case, but the guide did not recommend them clearly and its unqualified revocation claim overstated what happens to already-issued CDN URLs.

Changes

• Recommend authorized redirects for cached markup and long-lived private pages; keep direct delivery for request-authorized galleries.
• Explain that revocation denies new grants, issued CDN URLs remain valid until expiry, and downloaded bytes cannot be recalled. Document browser-attached session authorization.
• Show the existing five-minute expiry plus 30-second rotation settings (maximum five minutes thirty seconds), and use those explicit settings in the packed redirect fixture. Package defaults and runtime implementation are unchanged.
• Reuse the original encrypted capability after its first CDN target expires, verify a renewed target, revoke access and verify an empty private/no-store 404.

Verification

• New packed-fixture lifetime assertion failed against the former one-hour fixture configuration before changing it to the documented short policy.
• The fake-time renewal/revocation regression already passed on the existing implementation: this PR selects and documents existing behavior, not a runtime fix.
• yarn workspace @transloadit/img check: 76 tests plus type fixtures.
• yarn test:img:fixture: packed Next build and signing/authorization/tampering/expiry/secret-exclusion checks.

PR C, stacked on #498 (which follows #497). No merge/publication or changes to production settings. Council remains with the orchestrator after this round; native browser authorization proof remains a separate next step.

[kvz]

Superseded by #500, which now carries the whole change against main.