Serve and accept JPEG XL as an image format (part of #222)

A JPEG XL source, a bare codestream or one in its container, is
fetched, detected and decoded, and orig of one is JPEG XL. The format
jxl works in plain and encrypted URLs and on the generator page,
served as image/jxl, and auto chooses it first when Accept names
image/jxl.

govips sends libvips a JPEG XL distance with every save, and libvips
then ignores the quality, so q is turned into a distance with libvips'
formula, keeping 100 lossy. govips cannot have libvips strip metadata
from JPEG XL, so it is removed from the image before saving; libvips
8.16 and later still add an EXIF block of their own, with nothing from
the source. The conversion to sRGB moved ahead of the format switch.

Model: opus-5-5

TODO.md

@@ -30,6 +30,19 @@ P2: security: per-IP rate limiting on the image routes
 
 # Completed Steps
 
+- 2026-10-08 JPEG XL as an input and output format (part of #222): a source
+  whose bytes start with either JPEG XL signature, the bare codestream's `FF 0A`
+  or the container's, is detected as `image/jxl`, which the upstream fetch
+  accepts; `orig` of such a source is JPEG XL. The format `jxl` works in plain
+  and encrypted URLs and on the generator page, served as `image/jxl` and cached
+  like the other formats. `auto` chooses JPEG XL first when `Accept` names
+  `image/jxl`. govips sends libvips a JPEG XL distance with every save, so
+  libvips ignores the quality: pixa turns `q` into a distance with libvips' own
+  formula, keeping 100 lossy, and removes the metadata from the image before
+  saving, as govips cannot have libvips strip it from JPEG XL. libvips still
+  writes an EXIF block of its own into JPEG XL (orientation, resolution, size,
+  colour space, fixed defaults), with nothing from the source. libvips' default
+  effort, 7, is kept. JPEG XL is not yet the default output.
 - 2026-10-08 requests no longer wait behind eviction queries that read a whole
   table (closes #227): the new `cache_usage` table holds the total cache usage,
   kept up to date by triggers on `source_content` and `variant_content` in the