Keep WebP, AVIF and JPEG XL encodes at the limits under 40 seconds (closes #272)

WebP is saved at effort 2 and JPEG XL at effort 4, and an AVIF output of
more than 16,777,216 pixels is refused with 400 before anything is
decoded, as AVIF is already at the lowest effort govips can set. With one
libvips thread, 8192x8192 random pixels with an alpha channel take up to
about 23 seconds as WebP and 27 as JPEG XL, and 4096x4096 as AVIF about
25. Resizing with fit=cover already decodes the input, so the output's
dimensions are now worked out before resizing, in outputDimensions.
Reading the input moves into readInput to keep Process within the
linter's limits.

Model: opus-5-5

TODO.md

@@ -30,6 +30,17 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-15 a WebP, AVIF or JPEG XL encode at the limits takes at most about 27
+  seconds (closes #272): with one libvips thread, 8192x8192 random pixels with
+  an alpha channel took about 61 seconds to encode as WebP, 99 as AVIF and 81 as
+  JPEG XL, so with the default `downstream_timeout` of 60 seconds such an image
+  was never delivered, yet its encode held a processing slot to the end. WebP is
+  now saved at effort 2 and JPEG XL at effort 4, which take up to about 23 and
+  27 seconds. AVIF was already at the lowest effort govips can set, so an AVIF
+  output of more than 16,777,216 pixels is refused with 400 before anything is
+  decoded; 4096x4096 or 8192x2048 takes up to about 25 seconds. Resizing with
+  `fit=cover` already decodes the input, so the output's dimensions are worked
+  out before resizing. `README.md` gives the limit and the new times.
 - 2026-10-15 the request metrics record any method that is not a standard one as
   `other` (closes #274): their `method` label was each request's method as sent,
   and Go's HTTP server accepts any method name, so a client sending made-up