feat: add hash bucket storage and thumbnail caching

- Store avatars in 3-level deep hash bucket directories based on
SHA256 of DID to prevent large flat directories
- Cache thumbnails alongside full-size images to avoid repeated scaling
- Return placeholder avatar for invalid/unresolvable identifiers
instead of 404 errors
- Support did:web identifiers (already handled by Indigo library)

internal/cache/cache.go

···
 package cache
 
 import (
+    "crypto/sha256"
+    "encoding/hex"
     "os"
     "path/filepath"
     "strings"
···
         return nil, err
     }
     return &Cache{storePath: storePath}, nil
+}
+
+// hashBucketPath returns a 3-level deep directory path based on SHA256 of the DID
+func hashBucketPath(did string) string {
+    hash := sha256.Sum256([]byte(did))
+    hexHash := hex.EncodeToString(hash[:])
+    return filepath.Join(hexHash[0:2], hexHash[2:4], hexHash[4:6])
 }
 
 // didToFilename converts a DID to a safe filename
···
     return strings.ReplaceAll(did, ":", "_") + ".jpg"
 }
 
+// didToThumbFilename converts a DID to a thumbnail filename
+func didToThumbFilename(did string) string {
+    return strings.ReplaceAll(did, ":", "_") + "_thumb.jpg"
+}
+
 // Get retrieves an avatar from the cache
 func (c *Cache) Get(did string) ([]byte, bool) {
     c.mu.RLock()
     defer c.mu.RUnlock()
 
-    path := filepath.Join(c.storePath, didToFilename(did))
+    path := filepath.Join(c.storePath, hashBucketPath(did), didToFilename(did))
+    data, err := os.ReadFile(path)
+    if err != nil {
+        return nil, false
+    }
+    return data, true
+}
+
+// GetThumbnail retrieves a cached thumbnail from the cache
+func (c *Cache) GetThumbnail(did string) ([]byte, bool) {
+    c.mu.RLock()
+    defer c.mu.RUnlock()
+
+    path := filepath.Join(c.storePath, hashBucketPath(did), didToThumbFilename(did))
     data, err := os.ReadFile(path)
     if err != nil {
         return nil, false
···
     c.mu.Lock()
     defer c.mu.Unlock()
 
-    path := filepath.Join(c.storePath, didToFilename(did))
+    bucketDir := filepath.Join(c.storePath, hashBucketPath(did))
+    if err := os.MkdirAll(bucketDir, 0755); err != nil {
+        return err
+    }
+    path := filepath.Join(bucketDir, didToFilename(did))
+    return os.WriteFile(path, data, 0644)
+}
+
+// SetThumbnail stores a thumbnail in the cache
+func (c *Cache) SetThumbnail(did string, data []byte) error {
+    c.mu.Lock()
+    defer c.mu.Unlock()
+
+    bucketDir := filepath.Join(c.storePath, hashBucketPath(did))
+    if err := os.MkdirAll(bucketDir, 0755); err != nil {
+        return err
+    }
+    path := filepath.Join(bucketDir, didToThumbFilename(did))
     return os.WriteFile(path, data, 0644)
 }
 
-// Delete removes an avatar from the cache
+// Delete removes an avatar and its thumbnail from the cache
 func (c *Cache) Delete(did string) error {
     c.mu.Lock()
     defer c.mu.Unlock()
 
-    path := filepath.Join(c.storePath, didToFilename(did))
-    err := os.Remove(path)
-    if os.IsNotExist(err) {
-        return nil
+    bucketDir := filepath.Join(c.storePath, hashBucketPath(did))
+
+    avatarPath := filepath.Join(bucketDir, didToFilename(did))
+    if err := os.Remove(avatarPath); err != nil && !os.IsNotExist(err) {
+        return err
     }
-    return err
+
+    thumbPath := filepath.Join(bucketDir, didToThumbFilename(did))
+    if err := os.Remove(thumbPath); err != nil && !os.IsNotExist(err) {
+        return err
+    }
+
+    return nil
 }

internal/server/server.go

···
     did, err := s.fetcher.ResolveDID(ctx, identifier)
     if err != nil {
         log.Printf("Error resolving DID for %s: %v", identifier, err)
-        http.Error(w, "Not found", http.StatusNotFound)
+        s.serveAvatar(w, GetDefaultAvatar(), false)
         return
     }
 
···
     result, err := s.fetcher.Fetch(ctx, identifier)
     if err != nil {
         log.Printf("Error fetching avatar for %s: %v", identifier, err)
-        http.Error(w, "Internal server error", http.StatusInternalServerError)
+        s.serveAvatar(w, GetDefaultAvatar(), false)
         return
     }
 
···
     did, err := s.fetcher.ResolveDID(ctx, identifier)
     if err != nil {
         log.Printf("Error resolving DID for %s: %v", identifier, err)
-        http.Error(w, "Not found", http.StatusNotFound)
+        s.serveDefaultThumbnail(w)
+        return
+    }
+
+    if data, ok := s.cache.GetThumbnail(did); ok {
+        s.serveAvatar(w, data, true)
         return
     }
 
···
         result, err := s.fetcher.Fetch(ctx, identifier)
         if err != nil {
             log.Printf("Error fetching avatar for %s: %v", identifier, err)
-            http.Error(w, "Internal server error", http.StatusInternalServerError)
+            s.serveDefaultThumbnail(w)
             return
         }
 
         if !result.HasAvatar {
-            thumbnail, err := avatar.ScaleToSize(GetDefaultAvatar(), 128, 128)
-            if err != nil {
-                log.Printf("Error scaling default avatar: %v", err)
-                http.Error(w, "Internal server error", http.StatusInternalServerError)
-                return
-            }
-            s.serveAvatar(w, thumbnail, false)
+            s.serveDefaultThumbnail(w)
             return
         }
 
···
     thumbnail, err := avatar.ScaleToSize(avatarData, 128, 128)
     if err != nil {
         log.Printf("Error scaling avatar to thumbnail: %v", err)
-        http.Error(w, "Internal server error", http.StatusInternalServerError)
+        s.serveDefaultThumbnail(w)
         return
     }
 
+    if err := s.cache.SetThumbnail(did, thumbnail); err != nil {
+        log.Printf("Error caching thumbnail for %s: %v", did, err)
+    }
+
     s.serveAvatar(w, thumbnail, true)
 }
 
···
         w.Header().Set("Cache-Control", "no-cache")
     }
     w.Write(data)
+}
+
+func (s *Server) serveDefaultThumbnail(w http.ResponseWriter) {
+    thumbnail, err := avatar.ScaleToSize(GetDefaultAvatar(), 128, 128)
+    if err != nil {
+        log.Printf("Error scaling default avatar to thumbnail: %v", err)
+        http.Error(w, "Internal server error", http.StatusInternalServerError)
+        return
+    }
+    s.serveAvatar(w, thumbnail, false)
 }
 
 func handleHealthcheck(w http.ResponseWriter, r *http.Request) {