feat(lagoon): WebP variants of attachment thumbnails

- attach.VariantKey: a thumbnail's copy in another format next to it
- attach/webp (separate package, so only binaries that import it link
  the encoder): Encode at quality 80 and Variant, which writes the WebP
  copy of a thumbnail once and leaves no file on a failed encode
- github.com/gen2brain/webp v0.6.4, decided in
  .planning/notes/2026-10-28-webp-gen2brain.md
- lagoon README and docs/database/attachments.md

modules/lagoon/attach/variant.go

@@ -0,0 +1,28 @@
+package attach
+
+import (
+	"path"
+	"strings"
+)
+
+// VariantKey is the blob key of a thumbnail's copy in another image format,
+// stored next to the thumbnail: thumbKey with its extension replaced by
+// format, so thumb_42_480_0_0_0_auto.jpg becomes
+// thumb_42_480_0_0_0_auto.webp. When the thumbnail already carries that
+// extension (a thumbnail of a .webp original holds JPEG bytes under the
+// original's name, see ThumbKey), format is appended instead
+// (thumb_42_480_0_0_0_auto.webp.webp), so the variant never overwrites the
+// thumbnail. format follows the token rule of ThumbFilename ([a-z0-9]+,
+// lower-cased first); an empty thumbKey or a format outside the rule
+// answers "".
+func VariantKey(thumbKey, format string) string {
+	format = strings.ToLower(format)
+	if thumbKey == "" || !thumbToken.MatchString(format) {
+		return ""
+	}
+	ext := path.Ext(thumbKey)
+	if strings.EqualFold(strings.TrimPrefix(ext, "."), format) {
+		return thumbKey + "." + format
+	}
+	return strings.TrimSuffix(thumbKey, ext) + "." + format
+}