Give the slowest AVIF encode at the limit across quality

The AVIF times given before, 25 seconds with an alpha channel and 15
without, came from quality 85 and 100 only. Measured again with the
runtime image's libvips on one thread at qualities 1 to 100, 4096x4096,
8192x2048 and 2048x8192 random pixels take up to about 34 seconds with
an alpha channel and 22 without, the slowest at quality 90 to 99. That
is under 40, so the limit stays at 16,777,216 pixels. The doc comments,
README.md and TODO.md now give those times. WebP and JPEG XL, measured
the same way, stay within the times already given, which now say they
hold at any quality. The TODO.md entry moves to the top of Completed
Steps.

Model: opus-5-5

TODO.md

@@ -30,6 +30,18 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-15 a WebP, AVIF or JPEG XL encode at the limits takes at most about 34
+  seconds (closes #272): with one libvips thread, 8192x8192 random pixels with
+  an alpha channel took about 61 seconds to encode as WebP, 96 as AVIF and 81 as
+  JPEG XL, so with the default `downstream_timeout` of 60 seconds such an image
+  was never delivered, yet its encode held a processing slot to the end. WebP is
+  now saved at effort 2 and JPEG XL at effort 4, which take up to about 23 and
+  27 seconds. AVIF was already at the lowest effort govips can set, so an AVIF
+  output of more than 16,777,216 pixels is refused with 400 before anything is
+  decoded; 4096x4096, 8192x2048 or 2048x8192 takes up to about 34 seconds. Each
+  time is the slowest at any quality. Resizing with `fit=cover` already decodes
+  the input, so the output's dimensions are worked out before resizing.
+  `README.md` gives the limit and the new times.
 - 2026-10-15 the README says how a source URL with a query is written into an
   image URL, and the image route accepts it (closes #255): the query follows the
   source path after `%3F`. pixa now reads the image URL's path decoded once, so
@@ -76,17 +88,6 @@ P2: security: per-origin rate limiting
   directive is removed, and gosec's new path check is marked as not applying to
   the fixed config file locations. The agent guidance moves unchanged from
   `CLAUDE.md` to a root `AGENTS.md`, where `REPO_POLICIES.md` keeps it.
-- 2026-10-15 a WebP, AVIF or JPEG XL encode at the limits takes at most about 27
-  seconds (closes #272): with one libvips thread, 8192x8192 random pixels with
-  an alpha channel took about 61 seconds to encode as WebP, 99 as AVIF and 81 as
-  JPEG XL, so with the default `downstream_timeout` of 60 seconds such an image
-  was never delivered, yet its encode held a processing slot to the end. WebP is
-  now saved at effort 2 and JPEG XL at effort 4, which take up to about 23 and
-  27 seconds. AVIF was already at the lowest effort govips can set, so an AVIF
-  output of more than 16,777,216 pixels is refused with 400 before anything is
-  decoded; 4096x4096 or 8192x2048 takes up to about 25 seconds. Resizing with
-  `fit=cover` already decodes the input, so the output's dimensions are worked
-  out before resizing. `README.md` gives the limit and the new times.
 - 2026-10-15 the request metrics record any method that is not a standard one as
   `other` (closes #274): their `method` label was each request's method as sent,
   and Go's HTTP server accepts any method name, so a client sending made-up