fix(thumbs): the cache aged the booth it cached, and two more surfaces

Two corrections to the thumbnail work, the first of them a live bug shipped an
hour ago and caught by design-dev before its worst form landed.

⚠ GENERATING A THUMBNAIL RESET THE BOOTH'S EXPIRY CLOCK. `_newest_mtime`
excludes `.lock` sidecars because machinery is not the operator doing something;
the thumbnail cache is machinery too, and it is written by the SERVER on a mere
view. Excluding the cache's CONTENTS turned out not to be enough — creating
`.thumbs/` touches the BOOTH DIRECTORY's own mtime, which is exactly what
_newest_mtime seeds from. The booth's stamp is now restored across the mkdir,
which cannot hide real activity because any file an agent adds is counted by its
own mtime in the same walk.

The failure this prevents is not small. Once the Desk's preview strip pulls a
thumbnail per booth, ONE INDEX LOAD would have pushed every booth's expiry out
and the TTL would never have fired again — nothing would ever sweep. It was
already live for the gallery, one booth at a time.

TWO MORE SURFACES, because the fix only helped where it was wired:

  Desk preview strip  four small images per booth on the page he opens FIRST.
                      design-dev measured 28 originals / 24.1 MB on a 12-booth
                      copy; live has 28. The heaviest surface in the service,
                      heavier than the gallery it previews.
  flag tray           _marks.html rendered originals as tray thumbnails.

The review stage stays on the original, because that is the full-size review.

754 green plus the new guards.

tests/test_thumbs.py

@@ -161,3 +161,19 @@ def test_the_filmstrip_and_tray_use_thumbnails_but_the_stage_does_not(tmp_path):
     assert 'src="b.png?thumb=1"' in html, "the filmstrip still pulls full images"
     assert 'src="b.png"' not in html.replace('src="b.png?thumb=1"', ""), \
         "a full-size frame survived in the strip"
+
+
+def test_the_desk_preview_strip_uses_thumbnails(tmp_path):
+    """The heaviest surface in the service, on the page he opens FIRST: four
+    small images per booth, across every booth. design-dev measured 28
+    originals / 24.1 MB on a 12-booth copy; live has 28 booths.
+
+    Defeating change: `it.url` in the preview tuple."""
+    for name in ("one", "two"):
+        b = tmp_path / name
+        for n in ("a.png", "b.png"):
+            _img(b / n, 1024, 1024)
+    c = TestClient(create_app(tmp_path, ttl_hours=24, start_sweeper=False))
+    html = c.get("/").text
+    assert 'src="/b/one/a.png?thumb=1"' in html, "the Desk strip still pulls full images"
+    assert 'src="/b/one/a.png"' not in html