Refuse an image URL whose source path or query holds a # (closes #286)

A # written as %23 in the source path or query reached the parser
decoded and stayed in the source URL, where Go reads it as the start of
a fragment and drops it before fetching. So each text after the # was
another unsigned spelling of one upstream request, cached under its own
keys. An image URL whose decoded source path or query holds a # is now
refused with 400, signed or not, and README.md's rule for writing a
source path and query says a # cannot be part of either.

Model: opus-5-5

TODO.md

@@ -30,6 +30,11 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-15 a `/v1/image/` URL whose source path or source query holds a `#`,
+  written as `%23`, is refused with 400 (closes #286): the source URL built from
+  it ended at the `#` when fetched, so each text after it fetched the same
+  upstream image, without a signature for an allowlisted host, and cached it
+  under keys of its own. `README.md` says neither may hold a `#`.
 - 2026-10-15 the host of a `/v1/image/` URL must be a host name or an IPv4
   address (letters, digits, hyphens, underscores and dots) or an IPv6 address in
   brackets, either one optionally followed by `:` and a port, and any other host