Fix: Serve promoted images with a + without redirecting

Rule conditions see the original path, so chained rules can't encode +s. One
rule per number of +s does it instead, which only fits the free plan's 10
rules if they're shared by all sites, so static files now live under their
hostname (/free.direct-img.link/1/orange%2Bcat).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

public/_headers

@@ -1,14 +1,14 @@
 # Promoted images (scripts/promote.js) have no file extension, so they'd go out without a Content-Type. Browsers detect
 # JPEG, PNG, GIF and WebP from the bytes whatever type is declared, so promote.js promotes only those.
-/web/*
+/direct-img.link/*
   Content-Type: image/jpeg
   Cache-Control: public, max-age=604800
   Access-Control-Allow-Origin: *
-/free/*
+/free.direct-img.link/*
   Content-Type: image/jpeg
   Cache-Control: public, max-age=604800
   Access-Control-Allow-Origin: *
-/ai/*
+/ai.direct-img.link/*
   Content-Type: image/jpeg
   Cache-Control: public, max-age=604800
   Access-Control-Allow-Origin: *