Encode ' in the source query; the generator compares the path as written

A "'" in the source query is percent-encoded with the other characters
a browser encodes in a query. The generator page compares the URL pixa
would fetch with the path as written, which url.URL keeps in RawPath,
so a path holding %2F is refused whatever else it holds. It also
refuses a source URL holding a user name and password, which pixa does
not send, and a source path holding a ".." segment, as /v1/image/ does.
README.md and TODO.md say so.

Model: opus-5-5

README.md

@@ -339,11 +339,11 @@ percent-escape. So `my%20cat.jpg` in the image URL is the source path
 `/my%20cat.jpg`, fetched as `/my%2520cat.jpg`; and `100%25.png` is fetched as
 `/100%25.png`. The source query is the source URL's query as that URL writes it,
 its percent-escapes included, and is sent as it is, except that the characters a
-browser percent-encodes in a query (a space, `"`, `<`, `>`, control characters
-and characters outside ASCII) and a `%` that does not begin a percent-escape are
-percent-encoded. pixa signs and caches the query in that form, so
-`img%3Fname=my%20cat` and `img%3Fname=my%2520cat` in the image URL are the same
-source query, `name=my%20cat`.
+browser percent-encodes in a query (a space, `"`, `'`, `<`, `>`, control
+characters and characters outside ASCII) and a `%` that does not begin a
+percent-escape are percent-encoded. pixa signs and caches the query in that
+form, so `img%3Fname=my%20cat` and `img%3Fname=my%2520cat` in the image URL are
+the same source query, `name=my%20cat`.
 
 A size with one side `0` has that side scaled to keep the source's proportions,
 and is refused with 400 when that side would come out above 8192, the most
@@ -459,11 +459,13 @@ nor change what it asks for.
    sent with an empty format, or none, also makes a JPEG XL URL. Width and
    height both empty or `0` keep the original size; if only one of them is empty
    or `0`, that side is scaled to keep the image's proportions. A URL whose
-   scaled side would come out above 8192 answers 400. So does a source URL that
-   the image URL would fetch written another way, such as one whose path holds
-   `%2F`, fetched as `/`, or `(`, fetched as `%28`, as pixa keeps the source
-   path decoded and fetches it percent-encoded again (see Routes); the page then
-   shows the URL pixa would fetch.
+   scaled side would come out above 8192 answers 400, and so does a source URL
+   whose path holds a `..` segment. So does a source URL that the image URL
+   would fetch written another way, and the page then shows the URL pixa would
+   fetch: one with a user name and password, which pixa does not send, or one
+   whose path holds `%2F`, fetched as `/`, or `(`, fetched as `%28`, as pixa
+   keeps the source path decoded and fetches it percent-encoded again (see
+   Routes).
 3. The page shows the URL, `https://<host>/v1/e/<token>/img.<format>`, and when
    it expires. `<host>` is the host the page was opened on, and the URL starts
    with `http` instead while `debug` is on. The name after the token is ignored