Refuse a size whose computed side exceeds the maximum (closes #241)

A side given as 0 is computed from the source's proportions, and
nothing held it to 8192: 0x8192 of a 3000x600 source was resized to
40960x8192 and encoded. Process now refuses such a size with
ErrOutputTooLarge once it knows the source's dimensions, before the
resize and the encode, and both image routes answer it 400 with the
JSON error body. It is a processing error, not a failed fetch, so it
is never negative-cached. imgcache.MaxDimension is now
imageprocessor.MaxOutputDimension, so the request limit and the output
limit are one value. README.md says it under Routes and Encrypted URLs.

Model: opus-5-5

internal/imageprocessor/imageprocessor.go

@@ -133,6 +133,14 @@ var ErrInputTooLarge = errors.New("input image dimensions exceed maximum")
 // configured byte limit.
 var ErrInputDataTooLarge = errors.New("input data exceeds maximum allowed size")
 
+// MaxOutputDimension is the maximum width or height of an output image, and
+// so of a requested size (imgcache.MaxDimension).
+const MaxOutputDimension = 8192
+
+// ErrOutputTooLarge is returned when a size with one side 0 would give that
+// side, computed from the input's proportions, more than MaxOutputDimension.
+var ErrOutputTooLarge = errors.New("output image dimensions exceed maximum")
+
 // ErrUnsupportedOutputFormat is returned when the requested output format is
 // not supported.
 var ErrUnsupportedOutputFormat = errors.New("unsupported output format")
@@ -262,6 +270,13 @@ func (p *ImageProcessor) Process(
 	// Determine target dimensions
 	targetWidth, targetHeight := targetDimensions(req.Size, origWidth, origHeight)
 
+	// A side given as 0 is computed from the input's proportions, so it can
+	// come out above MaxOutputDimension; refuse it before resizing
+	if targetWidth > MaxOutputDimension || targetHeight > MaxOutputDimension {
+		return nil, fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
+			targetWidth, targetHeight, MaxOutputDimension)
+	}
+
 	// Resize if needed
 	if targetWidth != origWidth || targetHeight != origHeight {
 		err := p.resize(img, targetWidth, targetHeight, req.FitMode)