Answer 502 for an upstream host with no address or a failed fetch (closes #367)

The image routes answered 500 and logged at error level when the upstream
host had no address, or when the fetch failed before the upstream
answered, such as on a refused connection. The fetcher now marks such a
failure with ErrUpstreamRequestFailed; a cancelled fetch is not marked.
respondImageError answers it, and ErrInvalidHost, 502 "upstream error"
and logs them at warn level. README Routes lists both under 502.

Model: opus-5-5

README.md

@@ -310,6 +310,9 @@ to any method the list does not give for it.
       neither the image nor its source in its cache.
     - 502 likewise for 5 minutes after a body whose first bytes are not those of
       its `Content-Type`.
+    - 502 when the upstream host has no address.
+    - 502 when the fetch fails before the upstream answers, such as on a refused
+      connection or a failed TLS handshake.
     - 503 when pixa is busy (see Limits).
     - 503 in maintenance mode.
     - 504 when the upstream has not sent its response headers within