Keep the empty host when the db_url path starts with //

defaultDBURL kept the empty host only when state_dir started with //,
but SQLite reads the path written into the URL, state_dir followed by
/state.sqlite3. For a state_dir of / that path is //state.sqlite3, the
URL started file:// and SQLite read state.sqlite3 as a host, so pixa
failed to start. The decision now looks at that path: a state_dir of
/ gives file:////state.sqlite3. Every other state_dir gives the same
URL as before.

Model: opus-5-5

TODO.md

@@ -30,6 +30,14 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-16 a `state_dir` whose name holds `%`, `?` or `#` keeps its database
+  at `state.sqlite3` in that directory (closes #290): the `db_url` derived from
+  it put the name into a `file:` URL as it was, so SQLite read `%41` as `A`, a
+  `?` or `#` ended the path early, and the journal mode parameter was lost. The
+  derived `db_url` is now built with Go's `net/url`, which writes those
+  characters as `%25`, `%3F` and `%23`. For a `state_dir` of `/` or one starting
+  with `//` it starts `file:////`, so SQLite no longer reads the first name in
+  the path as a host.
 - 2026-10-16 the source URL a request fetches is built with `net/url` from the
   source host, path and query, not joined as text (closes #288). The source
   path, decoded, is fetched percent-encoded again, so `100%25.png` fetches
@@ -43,14 +51,6 @@ P2: security: per-origin rate limiting
   another way, such as with `%2F` in the path, whatever else the path holds, or
   with a user name and password. It also answers 400 for a source path holding a
   `..` segment, as `/v1/image/` refuses one.
-- 2026-10-16 a `state_dir` whose name holds `%`, `?` or `#` keeps its database
-  at `state.sqlite3` in that directory (closes #290): the `db_url` derived from
-  it put the name into a `file:` URL as it was, so SQLite read `%41` as `A`, a
-  `?` or `#` ended the path early, and the journal mode parameter was lost. The
-  derived `db_url` is now built with Go's `net/url`, which writes those
-  characters as `%25`, `%3F` and `%23`. For a `state_dir` starting with `//` it
-  starts `file:////`, so SQLite no longer reads the first directory name as a
-  host.
 - 2026-10-15 a thin source requested with `fit=cover` no longer makes libvips
   build a huge image (closes #282): libvips' thumbnail scaled the whole source
   to cover the requested size and copied that into memory before it cut out the