Fix silent fallbacks for unsupported formats and fit modes

- Return ErrUnsupportedOutputFormat for WebP/AVIF encoding
- Return ErrInvalidFitMode for unknown fit mode values
- Add ValidateFitMode() for input validation
- Validate fit mode at handler level before processing

Silent fallbacks violate the principle of least surprise and mask bugs.
When a user explicitly specifies a value, we should either honor it or
return an error - never silently substitute a different value.

internal/handlers/image.go

@@ -54,6 +54,11 @@ func (s *Handlers) HandleImage() http.HandlerFunc {
 
 		if fit := query.Get("fit"); fit != "" {
 			req.FitMode = imgcache.FitMode(fit)
+			if err := imgcache.ValidateFitMode(req.FitMode); err != nil {
+				s.respondError(w, "invalid fit mode: "+fit, http.StatusBadRequest)
+
+				return
+			}
 		}
 
 		// Default quality if not set