Serves rendered OG PNGs from the on-disk cache.

Route: GET /og-image/:key.png → 200 PNG bytes if the cache file exists, 404 otherwise. The cache key is the hash returned by PhoenixKitOG.Render.Cache.key_and_path/2; renders are cheap to rebuild on cache miss, but refine_og/4 always renders first and embeds the URL only on success, so a 404 here means an external cache-warm request or a long-since-purged entry.

Public route — no auth — because OG image consumers (Facebook, Twitter, LinkedIn crawlers) don't carry sessions.