Store shared private images by content hash

Keep one immutable JPEG, PNG, or WebP file per image in the shared data
store. Validate size and format before atomic publication, and preserve
image files and modes in backups. The WebP config decoder needs x/image
because the standard library has no WebP decoder.