Refuse an image URL host that no URL host can be

Only @ was refused in the host of a /v1/image/ URL, so a ? written as
%3F gave the host cdn.example.com?x=1, which Go's URL parser reads as
cdn.example.com with a query: it passed the allowlist and each text
after the ? was cached under keys of its own. The host must now be a
host name or an IPv4 address (letters, digits, -, _ and .) or an IPv6
address in brackets, either one optionally followed by : and a port;
anything else is refused with 400. An IPv6 address without brackets,
which needed a signature, is refused too.

Model: opus-5-5

TODO.md

@@ -30,6 +30,17 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-15 the host of a `/v1/image/` URL must be a host name or an IPv4
+  address (letters, digits, hyphens, underscores and dots) or an IPv6 address in
+  brackets, either one optionally followed by `:` and a port, and any other host
+  is refused with 400 (closes #275): only `@` was refused, so a `?` written as
+  `%3F` gave the host `cdn.example.com?x=1`, which Go's URL parser reads as
+  `cdn.example.com` with a query. Such a URL passed the allowlist, and each text
+  after the `?` fetched the host's root path and cached the answer under keys of
+  its own. A `#`, `%`, `\` or space written percent-encoded is refused the same
+  way, and so is an IPv6 address without brackets, which needed a signature
+  before. Underscores are kept because `allowlist_hosts` accepts host names
+  holding them.
 - 2026-10-15 the README says how a source URL with a query is written into an
   image URL, and the image route accepts it (closes #255): the query follows the
   source path after `%3F`. pixa now reads the image URL's path decoded once, so