fix: 404 for missing entries/groups/icons, repair icon caching headers

[allamiro]

Fixes #281, fixes #282.

Problem

• Requesting a non-existent entry/group/protected field/icon returned 500 Internal Server Error, indistinguishable from real server faults (Entry/group 'not found' returns 500 instead of 404 #282)
• The icon endpoint's Cache-Control: max-age=31536000; public; s-max-age=31536000 is invalid (semicolons instead of commas, s-max-age instead of s-maxage) so browsers ignored it and re-fetched icons; content type was always image/png regardless of the data (Icon endpoint: malformed Cache-Control, wrong status for missing icons, hardcoded PNG #281)

Changes

• new NotFoundError type in keepass.rs; lookups return it and handlers map it to 404 via a shared error_response() helper (resolves the existing 'Serve 404 if icon not found' TODO)
• icon Cache-Control fixed: public, max-age=31536000, s-maxage=31536000, immutable
• icon content type sniffed from magic bytes (PNG/JPEG/GIF/SVG, falling back to PNG — the previous behavior — for unknown data), resolving the 'sniff content type' TODO
• unit tests for the 404 mapping and mime sniffing

Testing

cargo test: 11/11 pass (2 new) in a rust:1.83 container.

---

Summary by cubic

Return 404 for missing entries, groups, protected fields, and icons instead of 500. Fix icon caching headers and MIME detection so browsers cache icons correctly. Fixes #281 and #282.

• Bug Fixes
  • Added NotFoundError and a shared error_response to map not-found cases to 404.
  • Updated get_group_entries, get_entry, get_protected, and get_icon to use the new mapping.
  • Corrected icon Cache-Control to "public, max-age=31536000, s-maxage=31536000, immutable".
  • Sniff icon MIME type (PNG/JPEG/GIF/SVG) with PNG fallback; added tests for 404 mapping and MIME detection.

^{Written for commit fe86142. Summary will update on new commits.}