Fix silent fallbacks for unsupported formats and fit modes

- Return ErrUnsupportedOutputFormat for WebP/AVIF encoding
- Return ErrInvalidFitMode for unknown fit mode values
- Add ValidateFitMode() for input validation
- Validate fit mode at handler level before processing

Silent fallbacks violate the principle of least surprise and mask bugs.
When a user explicitly specifies a value, we should either honor it or
return an error - never silently substitute a different value.

internal/imgcache/imgcache.go

@@ -3,11 +3,15 @@ package imgcache
 
 import (
 	"context"
+	"errors"
 	"io"
 	"net/url"
 	"time"
 )
 
+// ErrInvalidFitMode is returned when an invalid fit mode is provided.
+var ErrInvalidFitMode = errors.New("invalid fit mode")
+
 // ImageFormat represents supported output image formats.
 type ImageFormat string
 
@@ -44,6 +48,17 @@ const (
 	FitOutside FitMode = "outside"
 )
 
+// ValidateFitMode checks if the given fit mode is valid.
+// Returns ErrInvalidFitMode for unrecognized fit modes.
+func ValidateFitMode(fit FitMode) error {
+	switch fit {
+	case FitCover, FitContain, FitFill, FitInside, FitOutside, "":
+		return nil
+	default:
+		return ErrInvalidFitMode
+	}
+}
+
 // ImageRequest represents a request for a processed image
 type ImageRequest struct {
 	// SourceHost is the origin host (e.g., "cdn.example.com")