Test that the image route refuses brackets around no IPv6 address

An IPv4 address in brackets, such as [203.0.113.5], and brackets around
no address at all, such as [abc], must be refused with 400. They now
pass the host check, and Go's URL parser refuses them later, so the
route answers 401. The new rows fail until the fix lands.

Model: opus-5-5

internal/handlers/image_errors_internal_test.go

@@ -265,12 +265,14 @@ func TestHandleImage_AllowlistOrSignature(t *testing.T) {
 	}
 }
 
-// TestHandleImage_InvalidHost_Returns400 sends image URLs whose host is
-// allowlistedHost with a character after it that a URL host cannot hold,
-// percent-encoded, and checks that each is refused with 400 naming the host
-// as decoded. A "?" or "#" there would otherwise end the host when the source
-// URL is read, so the request would pass the allowlist and be fetched and
-// cached under a host that is not the one fetched.
+// TestHandleImage_InvalidHost_Returns400 sends image URLs whose host no URL
+// host can be, and checks that each is refused with 400 naming the host as
+// decoded: allowlistedHost with a character after it that a URL host cannot
+// hold, percent-encoded, an IPv6 address without brackets, and brackets
+// around something that is not an IPv6 address. A "?" or "#" after
+// allowlistedHost would otherwise end the host when the source URL is read,
+// so the request would pass the allowlist and be fetched and cached under a
+// host that is not the one fetched.
 func TestHandleImage_InvalidHost_Returns400(t *testing.T) {
 	t.Parallel()
 
@@ -287,6 +289,8 @@ func TestHandleImage_InvalidHost_Returns400(t *testing.T) {
 		{`\ written as %5C`, allowlistedHost + "%5Cx", allowlistedHost + `\x`},
 		{"space written as %20", allowlistedHost + "%20", allowlistedHost + " "},
 		{"IPv6 address without brackets", "2001:db8::1", "2001:db8::1"},
+		{"IPv4 address in brackets", "[203.0.113.5]", "[203.0.113.5]"},
+		{"no address in brackets", "[abc]", "[abc]"},
 	}
 
 	for _, tt := range tests {