Say which input the image processor refuses before decoding

README.md, the doc comment of ErrUnsupportedInputFormat and the TODO.md
entry say the 415 is for input whose first bytes libvips reads as
another format, and no longer read as refusing a damaged image in a
source format, which is decoded and answers 500. The doc comment of
TestImageProcessor_OrigOfUnnamedFormatRefused says TIFF is refused
before it is decoded.

Model: opus-5-5

TODO.md

@@ -36,14 +36,16 @@ P2: security: per-origin rate limiting
   an upstream `Content-Type` that is not one of the source formats, SVG
   included, where they answered 500. Before decoding, the image processor
   refuses with `ErrUnsupportedInputFormat`, also answered 415, any input that
-  govips' `DetermineImageType`, which picks the libvips loader, does not name as
-  a source format. That catches an SVG whose first bytes pass the first-bytes
-  check for another type, as an XML comment can make them do for AVIF; an SVG
-  whose first bytes do not pass that check answers 500, as before. `orig` is
-  always the source's own format, where a source the processor could not name
-  was saved as JPEG. `README.md` no longer lists SVG. The SVG detection in
-  `internal/magic` stays: the request path does not call it, and it goes with
-  the unused code of https://git.eeqj.de/sneak/pixa/issues/168.
+  govips' `DetermineImageType`, which picks the libvips loader from the first
+  bytes, does not name as a source format. That catches an SVG whose first bytes
+  pass the first-bytes check for another type, as an XML comment can make them
+  do for AVIF; an SVG whose first bytes do not pass that check answers 500, as
+  before, and so does a damaged image in a source format, whose first bytes
+  `DetermineImageType` names. `orig` is always the source's own format, where a
+  source the processor could not name was saved as JPEG. `README.md` no longer
+  lists SVG. The SVG detection in `internal/magic` stays: the request path does
+  not call it, and it goes with the unused code of
+  https://git.eeqj.de/sneak/pixa/issues/168.
 - 2026-10-12 per-client limit on the image routes (closes #236): the new setting
   `image_requests_per_minute` (`PIXA_IMAGE_REQUESTS_PER_MINUTE`), default 600,
   is how many `GET` and `HEAD` requests one client may send to `/v1/image/` and