Accept a source path or query holding %25 in an image URL

The path traversal check now reads only the host and source path, not
the source query, and keeps a "%" that does not start a percent-escape
as it is, decoding the escapes around it, instead of refusing the URL.
Stopping the decoding at that "%" would let a double-encoded ".."
elsewhere in the path through.

Model: opus-5-5

TODO.md

@@ -40,7 +40,10 @@ P2: security: per-origin rate limiting
   `%2F`, `%3B` or `%2C`, as `GenerateSignedURL` wrote them, kept the `%3F` from
   being read as `?`, and the request failed with 401. `GenerateSignedURL` now
   writes Go's own encoding of the path. The README has an example with a query
-  and its signature.
+  and its signature. The path traversal check no longer reads the source query,
+  and keeps a `%` that does not start a percent-escape as it is instead of
+  refusing the URL, so a source path or query holding `%25` is accepted, while a
+  double-encoded `..` next to such a `%` is still refused.
 - 2026-10-15 `max_concurrent_processing` defaults to half the CPUs pixa sees,
   rounded down, and at least 1 (closes #242): it defaulted to one image per CPU,
   and a container with no CPU limit sees every CPU of the host, so on a 48-CPU