fix(meta): bound the TMDB response cache on disk

Closes #158

DESIGN.md

@@ -578,8 +578,11 @@ thing that can be down.
 fragments, never URLs; the browser composes the URL and chooses the size. No
 image proxy and no image cache in the service.
 
-**Rich detail is not persisted.** It is served through arr-meta's existing
-24-hour response cache. The single exception is `poster_path`, `backdrop_path`
+**Rich detail is not persisted.** It is served through arr-meta's 24-hour
+response cache, which lives on disk in a directory alongside the database
+(§10), bounded by both age and total size (#158) — not the database itself,
+and not an image cache; images stay hotlinked as above. The single exception
+is `poster_path`, `backdrop_path`
 and `vote_average`, stored on `movies` and `series` and written by the daily
 metadata refresh (§8), so library views render without a TMDB call.
 
@@ -624,7 +627,7 @@ service.
 Policy lives in the database, not a config file — size targets and DV rules get
 tuned by hand during testing and a restart-to-reload loop gets old immediately.
 Only bootstrap settings (bind address, Prowlarr URL, Transmission URL, TMDB key,
-media root) come from config/env.
+media root, TMDB response cache directory) come from config/env.
 
 Backup is `sqlite3 .backup` on a timer.