Fetch or render a signed image

Unauthenticated. sig is HMAC over the template id and query (except sig). Optional exp is a unix expiry. Other query keys map to layer text or variables. First unique payload renders and bills the template owner; later hits stream the stored file.