Refuse a q outside 1-100 on /v1/image/ with 400 (closes #134)

The route ignored a q that was not a number or was outside 1-100 and
used 85, so q=banana or q=500 was served as if q were absent and
verified against a signature made for 85.

It now reads q with the check the URL generator uses for its quality
field (parseFormInt with minQuality and maxQuality, default
encurl.DefaultQuality) and answers anything else with a 400 naming q
and the value. An absent or empty q is still 85. README.md states the
range.

Model: opus-5-5

TODO.md

@@ -31,11 +31,11 @@ exhaustion
 # Completed Steps
 
 - 2026-09-28 refuse an invalid `q` on `/v1/image/` (closes #134): a `q`
-  that is not a whole number from 1 to 100, an empty `q` included, is a
+  that is not a whole number from 1 to 100 is a 400 naming `q` and the
-  400 naming `q` and the value, instead of being served at the default
+  value, instead of being served at the default 85; the route reads `q`
-  85; the route reads `q` with the generator's quality check
+  with the generator's quality check (`parseFormInt` with `minQuality`
-  (`parseFormInt` with `minQuality` and `maxQuality`); only a `q` missing
+  and `maxQuality`); an absent or empty `q` is still 85; `README.md`
-  from the URL is still 85; `README.md` states the range.
+  states the range.
 - 2026-09-28 unknown `PIXA_` environment variables abort startup (closes
   #133): a variable whose name starts with `PIXA_` but is neither a
   setting's variable nor `PIXA_CONFIG_PATH` aborts startup naming it, as

internal/handlers/auth.go

@@ -18,9 +18,9 @@ import (
 	"sneak.berlin/go/pixa/internal/templates"
 )
 
-// errInvalidFormField reports a generator form field, or the q parameter of
+// errInvalidFormField reports a generator form field whose value is
-// /v1/image/, whose value is non-numeric or out of range. The offending field
+// non-numeric or out of range. The offending field name is wrapped in so the
-// name is wrapped in so the response can name it.
+// response can name it.
 var errInvalidFormField = errors.New("invalid")
 
 // Bounds for the generator's quality and ttl fields; the quality bounds also

internal/handlers/handlers_internal_test.go

@@ -294,24 +294,21 @@ func TestHandleImage_InvalidFitMode_Returns400(t *testing.T) {
 }
 
 // TestHandleImage_InvalidQuality_Returns400 verifies that the plain image
-// route answers a q that is not a whole number from 1 to 100, an empty one
+// route answers a q that is not a whole number from 1 to 100 with 400 naming
-// included, with 400 naming q and the value, instead of serving the image at
+// q and the value, instead of serving the image at the default quality 85.
-// the default quality 85.
 func TestHandleImage_InvalidQuality_Returns400(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		query, wantError string
+		q, wantError string
 	}{
-		{"q=banana", `invalid q: not a number, got "banana"`},
+		{"banana", `invalid q: not a number, got "banana"`},
-		{"q=0", `invalid q: must be from 1 to 100, got "0"`},
+		{"0", `invalid q: must be from 1 to 100, got "0"`},
-		{"q=101", `invalid q: must be from 1 to 100, got "101"`},
+		{"101", `invalid q: must be from 1 to 100, got "101"`},
-		{"q=", `invalid q: not a number, got ""`},
-		{"q=&q=500", `invalid q: not a number, got ""`},
 	}
 
 	for _, tt := range tests {
-		t.Run(tt.query, func(t *testing.T) {
+		t.Run("q="+tt.q, func(t *testing.T) {
 			t.Parallel()
 
 			fix := setupTestHandler(t)
@@ -320,7 +317,7 @@ func TestHandleImage_InvalidQuality_Returns400(t *testing.T) {
 			r.Get("/v1/image/*", fix.handler.HandleImage())
 
 			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet,
-				"/v1/image/"+fix.goodHost+"/images/photo.jpg/50x50.jpeg?"+tt.query, nil)
+				"/v1/image/"+fix.goodHost+"/images/photo.jpg/50x50.jpeg?q="+tt.q, nil)
 			rec := httptest.NewRecorder()
 
 			r.ServeHTTP(rec, req)

internal/handlers/image.go

@@ -102,22 +102,13 @@ func (s *Handlers) parseImageRequest(
 		}
 	}
 
-	// Parse optional quality and fit params. Only a q missing from the URL is
+	// Parse optional quality and fit params. An absent q is 85; a q that is
-	// 85. A q in the URL that is not a whole number from 1 to 100, an empty
+	// not a whole number from 1 to 100 is refused, checked as the generator
-	// one included, is refused, checked as the generator checks its quality
+	// checks its quality field.
-	// field; that check alone would take an empty q as missing.
-	qStr := query.Get("q")
-	if query.Has("q") && qStr == "" {
-		s.respondError(w, `invalid q: not a number, got ""`,
-			http.StatusBadRequest)
-
-		return nil, false
-	}
-
 	req.Quality, err = parseFormInt(query, "q",
 		encurl.DefaultQuality, minQuality, maxQuality)
 	if err != nil {
-		s.respondError(w, fmt.Sprintf("%v, got %q", err, qStr),
+		s.respondError(w, fmt.Sprintf("%v, got %q", err, query.Get("q")),
 			http.StatusBadRequest)
 
 		return nil, false