fix: encode source query in GenerateSignedURL to avoid malformed URLs

When a source URL has query parameters, GenerateSignedURL() was
embedding a bare '?' in the path, causing everything after it to be
parsed as the HTTP query string instead of as path segments. This
made the size/format segment unreachable by the URL parser.

Percent-encode the query string in the path segment so it remains
part of the path and can be correctly extracted by ParseImagePath.

Fixes #2

internal/imgcache/signature.go

@@ -6,6 +6,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"net/url"
 	"strconv"
 	"time"
 )
@@ -96,22 +97,24 @@ func (s *Signer) GenerateSignedURL(req *ImageRequest, ttl time.Duration) (path s
 		sizeStr = fmt.Sprintf("%dx%d", req.Size.Width, req.Size.Height)
 	}
 
-	// Build the path
-	path = fmt.Sprintf("/v1/image/%s%s/%s.%s",
-		req.SourceHost,
-		req.SourcePath,
-		sizeStr,
-		req.Format,
-	)
-
-	// Append query if present
+	// Build the path.
+	// When a source query is present, it is embedded as a path segment
+	// (e.g. /host/path?query/size.fmt) so that ParseImagePath can extract
+	// it from the last-slash split. The "?" inside a path segment is
+	// percent-encoded by clients but chi delivers it decoded, which is
+	// exactly what the URL parser expects.
 	if req.SourceQuery != "" {
-		// The query goes before the size segment in our URL scheme
-		// So we need to rebuild the path
-		path = fmt.Sprintf("/v1/image/%s%s?%s/%s.%s",
+		path = fmt.Sprintf("/v1/image/%s%s%%3F%s/%s.%s",
+			req.SourceHost,
+			req.SourcePath,
+			url.PathEscape(req.SourceQuery),
+			sizeStr,
+			req.Format,
+		)
+	} else {
+		path = fmt.Sprintf("/v1/image/%s%s/%s.%s",
 			req.SourceHost,
 			req.SourcePath,
-			req.SourceQuery,
 			sizeStr,
 			req.Format,
 		)