test: cover encrypted-URL and generator validation gaps (#62)

Failing tests for the missing validation on the encrypted-URL route and
the token generator: an encrypted token carrying an over-limit dimension
or an unrecognized fit mode must be rejected with 400; POST /generate
with a bad width, height, quality, ttl or fit must return 400, mint no
token, and name the field on the page; an empty quality takes 85 and the
largest accepted values still give an expiry in the future. Also covers
the shared imgcache validator and the plain image route's invalid fit
mode.

Model: opus-4-8 (implementation); opus-5-5 (rework)

internal/handlers/handlers_internal_test.go

@@ -276,3 +276,18 @@ func TestHandleImage_ETagHeader(t *testing.T) {
 		t.Errorf("ETag should be quoted, got %q", etag)
 	}
 }
+
+// TestHandleImage_InvalidFitMode_Returns400 verifies that the plain image
+// route rejects an unrecognized fit mode with 400.
+func TestHandleImage_InvalidFitMode_Returns400(t *testing.T) {
+	t.Parallel()
+
+	fix := setupTestHandler(t)
+
+	status := getImage(t, fix,
+		"/v1/image/"+fix.goodHost+"/images/photo.jpg/50x50.jpeg?fit=bogus")
+
+	if status != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d", status, http.StatusBadRequest)
+	}
+}