Encode ' in the source query; the generator compares the path as written

A "'" in the source query is percent-encoded with the other characters
a browser encodes in a query. The generator page compares the URL pixa
would fetch with the path as written, which url.URL keeps in RawPath,
so a path holding %2F is refused whatever else it holds. It also
refuses a source URL holding a user name and password, which pixa does
not send, and a source path holding a ".." segment, as /v1/image/ does.
README.md and TODO.md say so.

Model: opus-5-5

TODO.md

@@ -30,6 +30,19 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-16 the source URL a request fetches is built with `net/url` from the
+  source host, path and query, not joined as text (closes #288). The source
+  path, decoded, is fetched percent-encoded again, so `100%25.png` fetches
+  `/100%25.png` where it answered 401, and `my%20cat.png` and `my%2520cat.png`
+  fetch different paths where both fetched `/my%20cat.png` under two cache keys.
+  The source query stays as the source URL writes it; the characters a browser
+  percent-encodes in a query, such as `'` or a space, which was sent raw and
+  answered 502, are percent-encoded when the image URL is read, so the query is
+  signed and cached as it is sent. The generator page answers 400, showing the
+  URL pixa would fetch, for a source URL its image URL would fetch written
+  another way, such as with `%2F` in the path, whatever else the path holds, or
+  with a user name and password. It also answers 400 for a source path holding a
+  `..` segment, as `/v1/image/` refuses one.
 - 2026-10-15 a thin source requested with `fit=cover` no longer makes libvips
   build a huge image (closes #282): libvips' thumbnail scaled the whole source
   to cover the requested size and copied that into memory before it cut out the
@@ -42,17 +55,6 @@ P2: security: per-origin rate limiting
   resident memory peaked at about 242 MiB for the 8192x64 source and 431 MiB for
   the 8192x1 one. The output can sit a fraction of an output pixel from where it
   was.
-- 2026-10-16 the source URL a request fetches is built with `net/url` from the
-  source host, path and query, not joined as text (closes #288). The source
-  path, decoded, is fetched percent-encoded again, so `100%25.png` fetches
-  `/100%25.png` where it answered 401, and `my%20cat.png` and `my%2520cat.png`
-  fetch different paths where both fetched `/my%20cat.png` under two cache keys.
-  The source query stays as the source URL writes it; the characters a browser
-  percent-encodes in a query, such as a space, which was sent raw and answered
-  502, are percent-encoded when the image URL is read, so the query is signed
-  and cached as it is sent. The generator page answers 400, showing the URL pixa
-  would fetch, for a source URL its image URL would fetch written another way,
-  such as with `%2F` in the path.
 - 2026-10-15 a `/v1/image/` URL whose source path or source query holds a `#`,
   written as `%23`, is refused with 400 (closes #286): the source URL built from
   it ended at the `#` when fetched, so each text after it fetched the same