Compress source paths and shorten URL signatures

[matthewnessworthy]

Resize-route source paths were the last uncompressed URL segment. This finishes the job started in #8.

What changed

• UrlCodec::compressSourcePath() emits the shortest of three deterministic forms: plain rawurlencoded segments, a dictionary token for the directory part with the filename kept plain (visible for image SEO), or a token for the whole path. S3 bucket names cannot start with _, so the token prefix is unambiguous against legacy paths — published URLs keep decoding unchanged.
• Signatures shrink 32 → 22 chars by encoding the same md5 digest as unpadded url-safe base64 instead of hex.

Measured on production-shaped paths with the frozen v1 dictionary:

source path	plain	compressed	saving
prop media, hash filename	106	81 (dirs token)	24%
gh-jobs advertiser image	76	34 (full token)	55%
horizon og-template asset	64	14 (full token)	78%
bucket/file.jpg	15	15 (stays plain)	—

Overall resize URLs come out 20–30% shorter. Template-route URLs only get the shorter signature (payload + params were already compressed; the SEO filename stays plain by design).

Rollout order

⚠️ RingierIMU/image-service-lambda#517 must deploy first. The service accepts both signature encodings and both source-path forms after that PR; only then can ventures pick up this release. New-format URLs produce fresh cache keys, so existing images re-render once on first hit — same one-time cost as the #8 rollout.

Verification

• 21 PHPUnit tests pass, including round-trips for all three forms and special characters (UTF-8, %, +, spaces)
• Cross-language: a URL generated by this branch was driven through the Lambda middleware chain end-to-end (token parse → signature validate → S3 path resolution → fmt sniff) — all correct

🤖 Generated with Claude Code