Support SVG sources (closes #68)

The fetcher accepts image/svg+xml again and internal/magic detects SVG.
A raster format renders the SVG at the least size that covers the
output, held to 8192 on a side, through libvips' thumbnail, which
renders at any scale, so an enlarged SVG stays sharp. An SVG's own size
is not limited; one with a side more than 8192 times the other is
ErrSVGTooThin, answered 415. orig of an SVG at the orig size is the SVG
unchanged, cached as a variant; at any other size it is
ErrSVGNotOriginalSize, answered 400. The cache reads up to 1024 first
bytes of a file to find its format. Render time and memory grow with
what the SVG draws: P1 in TODO.md. Tests that pinned SVG as refused now
expect it to be read.

Model: opus-5-5

TODO.md

@@ -26,10 +26,23 @@ resolved. The disk cache is now size-bounded with LRU eviction
 
 # Next Step
 
-P2: security: per-origin rate limiting
+P1: security: bound the time and memory of rendering an SVG source. Both grow
+with what the SVG draws, such as filter effects, and govips cannot stop or limit
+a render (https://git.eeqj.de/sneak/pixa/issues/68).
 
 # Completed Steps
 
+- 2026-11-11 SVG is a source format again (closes #68), by the owner's ruling.
+    - The fetcher accepts `image/svg+xml`, and `internal/magic` detects SVG.
+    - A raster format renders the SVG at the output size, so it stays sharp.
+      libvips' thumbnail renders it, at any scale.
+    - An SVG's own size is not limited. The output checks limit the size it is
+      rendered at, and no side is rendered above 8192.
+    - An SVG with one side more than 8192 times the other is `ErrSVGTooThin`,
+      answered 415.
+    - `orig` of an SVG at the `orig` size is the SVG unchanged, cached as a
+      variant. At any other size it is `ErrSVGNotOriginalSize`, answered 400.
+    - The cache reads up to 1024 first bytes of a file to find its format.
 - 2026-10-27 the reconciliation pass skips a directory it cannot list and a file
   whose info it cannot read, and goes on (closes #343). It stopped before its
   later checks at a directory it could not list, or at a source or variant file
@@ -1397,6 +1410,8 @@ P2: security: per-origin rate limiting
 
 # Future Steps
 
+- P2: security
+    - per-origin rate limiting
 - P2: HTTP response handling
     - Last-Modified headers
 - P2: configuration