Refuse a fit=outside size whose output exceeds the maximum (closes #257)

fit=outside scales the source to cover the requested size, and the side
scaled past it was held to no maximum: 1x8192?fit=outside of a 3000x600
source was resized to 40960x8192 and encoded. resize now refuses such an
output with ErrOutputTooLarge before resizing, so both image routes answer
it 400 with the error a size with one side 0 already gets. The other fit
modes make the requested size or one within it. README.md and TODO.md
say so.

Model: opus-5-5

internal/imageprocessor/imageprocessor.go

@@ -137,8 +137,10 @@ var ErrInputDataTooLarge = errors.New("input data exceeds maximum allowed size")
 // so of a requested size (imgcache.MaxDimension).
 const MaxOutputDimension = 8192
 
-// ErrOutputTooLarge is returned when a size with one side 0 would give that
-// side, computed from the input's proportions, more than MaxOutputDimension.
+// ErrOutputTooLarge is returned, before resizing, when the output would have a
+// side above MaxOutputDimension: the side of a size with one side 0, computed
+// from the input's proportions, or with FitOutside, the side scaled past the
+// requested size.
 var ErrOutputTooLarge = errors.New("output image dimensions exceed maximum")
 
 // ErrUnsupportedOutputFormat is returned when the requested output format is
@@ -460,7 +462,9 @@ func (p *ImageProcessor) detectFormat(imageType vips.ImageType) string {
 	}
 }
 
-// resize resizes the image according to the fit mode.
+// resize resizes the image according to the fit mode. With FitOutside one
+// side can come out larger than requested; when it would be above
+// MaxOutputDimension, resize returns ErrOutputTooLarge without resizing.
 func (p *ImageProcessor) resize(
 	img *vips.ImageRef, width, height int, fit FitMode,
 ) error {
@@ -508,6 +512,12 @@ func (p *ImageProcessor) resize(
 		newW := int(float64(imgW) * scale)
 		newH := int(float64(imgH) * scale)
 
+		// The dimension that exceeds the target is held to the maximum too
+		if newW > MaxOutputDimension || newH > MaxOutputDimension {
+			return fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
+				newW, newH, MaxOutputDimension)
+		}
+
 		return img.Thumbnail(newW, newH, vips.InterestingNone)
 
 	default: