Strip metadata from processed images (closes #82)

Every output is exported with govips' StripMetadata, so it carries no
EXIF, XMP, IPTC or ICC profile, the orig format included: it is always
re-encoded, and pixa never serves the source bytes. The image is turned
upright with AutoRotate right after decoding, so dropping the
orientation tag does not leave it rotated, and a requested size applies
to the upright image. An image with an ICC profile is converted to sRGB
before export, since clients show an image with no profile as sRGB.
No setting turns this off. README.md documents it.

Model: opus-5-5

README.md

@@ -111,6 +111,21 @@ with a private address can choose the address it is counted by through its own
 its own address is trusted too. Setting `trusted_proxies` to the proxy's own
 address closes this.
 
+### Image Metadata
+
+pixa decodes and re-encodes every image it serves, and removes all metadata from
+the output: EXIF (GPS position, camera make, model and serial number, capture
+time, embedded thumbnail), XMP, IPTC and the ICC colour profile. This cannot be
+turned off.
+
+- The `orig` format means the source's own format, not the source's bytes: an
+  `orig` image is re-encoded and stripped like any other.
+- An image with an EXIF orientation is turned upright first, so it displays the
+  same without the tag; a requested size applies to the upright image.
+- An image with an ICC profile is converted to sRGB first, since clients show an
+  image with no profile as sRGB. Colours outside sRGB, such as the most
+  saturated ones in a Display P3 photo, are clipped.
+
 ### Source Hosts
 
 Source hosts may be allowlisted in the configuration. Non-allowlisted