Refuse, before decoding, input libvips would not load as a source format

govips picks the libvips loader for the input with DetermineImageType.
The image processor now names the format from that type before decoding,
and refuses with ErrUnsupportedInputFormat, answered 415, any input it
cannot name as one of the six source formats. An SVG whose first bytes
pass the first-bytes check for AVIF therefore never reaches librsvg.
orig is the format named there. README.md and TODO.md say so.

Model: opus-5-5

TODO.md

@@ -34,12 +34,16 @@ P2: security: per-origin rate limiting
   of the source's own format (closes #68): the upstream fetch no longer accepts
   `image/svg+xml`, which libvips would render. Both image routes answer 415 for
   an upstream `Content-Type` that is not one of the source formats, SVG
-  included, where they answered 500. `orig` of a source in a format the image
-  processor cannot name is `ErrUnsupportedInputFormat`, also answered 415, where
-  it was saved as JPEG. `README.md` no longer lists SVG. The SVG detection in
+  included, where they answered 500. Before decoding, the image processor
+  refuses with `ErrUnsupportedInputFormat`, also answered 415, any input that
+  govips' `DetermineImageType`, which picks the libvips loader, does not name as
+  a source format. That catches an SVG whose first bytes pass the first-bytes
+  check for another type, as an XML comment can make them do for AVIF; an SVG
+  whose first bytes do not pass that check answers 500, as before. `orig` is
+  always the source's own format, where a source the processor could not name
+  was saved as JPEG. `README.md` no longer lists SVG. The SVG detection in
   `internal/magic` stays: the request path does not call it, and it goes with
-  the unused code of https://git.eeqj.de/sneak/pixa/issues/168. An SVG sent
-  under another image type still fails the first-bytes check and answers 500.
+  the unused code of https://git.eeqj.de/sneak/pixa/issues/168.
 - 2026-10-12 per-client limit on the image routes (closes #236): the new setting
   `image_requests_per_minute` (`PIXA_IMAGE_REQUESTS_PER_MINUTE`), default 600,
   is how many `GET` and `HEAD` requests one client may send to `/v1/image/` and