[P3] resolveImagePath rebuilds the project-root allowlist on every image request

[eboudrant]

Priority: P3 · Review finding: #22

src/handler.js resolveImagePath reads projects.json and realpathSyncs every project root per request — ×50 thumbnails per grid page, plus meta/slice calls.

Fix: cache the realpathed roots for a few seconds (or invalidate on project add/delete).