Serve images without PHP, add the 720 and 1280 steps, trim two hot paths

- Image widths are 480, 720, 960, 1280, 1600 and 2400. A phone needed
  721 pixels and got 960. Existing images receive the new steps from
  a task; stored pages pick them up at render time, so no document is
  rewritten. Mobile backgrounds use 720.
- A variant served once is mirrored to public/media, and a rewrite rule
  lets the web server deliver it from there. var/media stays the source.
- The hero preload follows the image each device really shows.
- The post navigation reads the order and then two posts instead of
  up to 500 documents.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

config/services.yaml

@@ -10,6 +10,9 @@ parameters:
     # das Projekt schreiben, und eine Installation mit schreibgeschuetztem public/ ebenfalls.
     kant.fonts_dir: '%kernel.project_dir%/public/assets/fonts'
     kant.asset_dir: '%kernel.project_dir%/public/assets'
+    # Das Abbild der Bildvarianten, das der Webserver ohne PHP ausliefert (App\Content\MediaMirror,
+    # ADR 129). MEDIA_MIRROR_DIRECTORY stellt es um; in Tests ist es aus.
+    kant.media_mirror_dir: '%kernel.project_dir%/public/media'
     kant.mail_log: '%kernel.project_dir%/var/log/mail.log'
     kant.mailer_dsn: 'sendmail://default'
     # Die Einstellung, die die Verwaltung anzeigt und ausprobiert; Tests setzen sie fest.
@@ -69,6 +72,10 @@ services:
     App\Content\StyleBundle:
         arguments:
             $assetDirectory: '%env(default:kant.asset_dir:ASSET_DIRECTORY)%'
+    App\Content\MediaMirror:
+        arguments:
+            $directory: '%env(default:kant.media_mirror_dir:MEDIA_MIRROR_DIRECTORY)%'
+            $mediaDirectory: '%env(projectdir:MEDIA_DIRECTORY)%'
     # Versand und Protokoll (ADR 121). MAIL_LOG nur fuer Tests, damit sie nicht ins echte var/log
     # schreiben.
     App\Ops\MailCheck:
@@ -209,5 +216,7 @@ services:
 # Frameworks nimmt. Hier und nicht in config/packages/test, weil diese Datei danach geladen wird.
 when@test:
     parameters:
+        # Tests schreiben nicht nach public/. Wer das Abbild prüft, setzt MEDIA_MIRROR_DIRECTORY.
+        kant.media_mirror_dir: ''
         kant.mail_log: '%kernel.cache_dir%/mail.log'
         kant.mail_dsn: 'smtp://cms.test:587'