Test that the image route refuses brackets around no IPv6 address

An IPv4 address in brackets, such as [203.0.113.5], and brackets around
no address at all, such as [abc], must be refused with 400. They now
pass the host check, and Go's URL parser refuses them later, so the
route answers 401. The new rows fail until the fix lands.

Model: opus-5-5

internal/handlers/image_errors_internal_test.go

@@ -265,12 +265,14 @@ func TestHandleImage_AllowlistOrSignature(t *testing.T) {
 	}
 }
 
-// TestHandleImage_InvalidHost_Returns400 sends image URLs whose host is
+// TestHandleImage_InvalidHost_Returns400 sends image URLs whose host no URL
-// allowlistedHost with a character after it that a URL host cannot hold,
+// host can be, and checks that each is refused with 400 naming the host as
-// percent-encoded, and checks that each is refused with 400 naming the host
+// decoded: allowlistedHost with a character after it that a URL host cannot
-// as decoded. A "?" or "#" there would otherwise end the host when the source
+// hold, percent-encoded, an IPv6 address without brackets, and brackets
-// URL is read, so the request would pass the allowlist and be fetched and
+// around something that is not an IPv6 address. A "?" or "#" after
-// cached under a host that is not the one fetched.
+// allowlistedHost would otherwise end the host when the source URL is read,
+// so the request would pass the allowlist and be fetched and cached under a
+// host that is not the one fetched.
 func TestHandleImage_InvalidHost_Returns400(t *testing.T) {
 	t.Parallel()
 
@@ -287,6 +289,8 @@ func TestHandleImage_InvalidHost_Returns400(t *testing.T) {
 		{`\ written as %5C`, allowlistedHost + "%5Cx", allowlistedHost + `\x`},
 		{"space written as %20", allowlistedHost + "%20", allowlistedHost + " "},
 		{"IPv6 address without brackets", "2001:db8::1", "2001:db8::1"},
+		{"IPv4 address in brackets", "[203.0.113.5]", "[203.0.113.5]"},
+		{"no address in brackets", "[abc]", "[abc]"},
 	}
 
 	for _, tt := range tests {