refactor: extract magic byte detection into internal/magic package

Move MIMEType, DetectFormat, ValidateMagicBytes, PeekAndValidate,
IsSupportedMIMEType, MIMEToImageFormat, and ImageFormatToMIME from
internal/imgcache into a new internal/magic package.

The magic package defines its own ImageFormat type and constants to
avoid circular imports (imgcache imports magic for validation,
magic cannot import imgcache).

Update import sites in imgcache/service.go and service_test.go.

Part of issue #39.

internal/imgcache/service.go

@@ -13,6 +13,7 @@ import (
 	"github.com/dustin/go-humanize"
 	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
+	"sneak.berlin/go/pixa/internal/magic"
 )
 
 // Service implements the ImageCache interface, orchestrating cache, fetcher, and processor.
@@ -277,7 +278,7 @@ func (s *Service) fetchAndProcess(
 	)
 
 	// Validate magic bytes match content type
-	if err := ValidateMagicBytes(sourceData, fetchResult.ContentType); err != nil {
+	if err := magic.ValidateMagicBytes(sourceData, fetchResult.ContentType); err != nil {
 		return nil, fmt.Errorf("content validation failed: %w", err)
 	}