Prerequisite for seed-packet capture (#81). majordomo's media pipeline is
stdlib-based and cannot decode HEIC or webp — and HEIC is the iPhone camera
default, so the capture feature's very first input would fail on the device
that motivates it. Normalizing at the upload boundary means everything
downstream only ever sees JPEG.

internal/imagenorm.Normalize(reader, opts) decodes any of jpeg/png/heic/webp,
downscales to fit MaxDim (2048, ollama-cloud's limit) on the longest edge with
Catmull-Rom (sharp on the text a packet is mostly made of), and re-encodes JPEG.

CGO stays off: github.com/gen2brain/heic runs libheif as WASM via wazero (pure
Go), golang.org/x/image/webp is pure Go. Both register with image.Decode. The
~5 MB these add only links into the binary when #81 imports this package — it's
not pulled into cmd/pansy yet, so main is unchanged in size for now.

Guards against hostile uploads: input capped at MaxBytes (ErrTooLarge) before a
full read, and the decoded pixel count checked from DecodeConfig BEFORE the
bitmap is allocated, so a small file claiming a huge canvas (a decompression
bomb) is refused up front.

TestNormalizeAllFormats round-trips all four formats to a valid JPEG — its real
job is catching a dropped blank import, where the intuition-breaking failure is
that the COMMON format (png) breaks while the exotic one (heic) still works.
heic/webp fixtures live in testdata (Go has no encoder for them); the webp is a
known-good 16x16 from Python's stdlib test corpus, verified to decode.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

@@ -0,0 +22,4 @@
+// Go's image decoders register via blank imports, and the failure mode is
+// backwards from intuition: forget "image/png" and PNG uploads fail with
+// "unknown format" while the exotic HEIC still works. So the blank imports below
+// are load-bearing, and TestNormalize exercises all four formats to keep them so.

@@ -0,0 +58,4 @@
+	// maxDecodePixels bounds the decoded bitmap regardless of input byte size — a
+	// small file can claim enormous dimensions (a decompression bomb). 100 MP is
+	// ~400 MB at 4 bytes/px decoded, already generous for any real photo.
+	maxDecodePixels = 100_000_000

@@ -0,0 +87,4 @@
+// ErrTooLarge means the input exceeded the byte cap or decoded to an absurd
+// pixel count. ErrUnsupported means the bytes weren't a decodable image format.
+var (
+	ErrTooLarge    = fmt.Errorf("imagenorm: image too large")

@@ -0,0 +98,4 @@
+//
+// It reads at most opts.MaxBytes and refuses a bitmap over maxDecodePixels, so a
+// hostile upload can neither exhaust memory by byte count nor by claimed
+// dimensions. A read/format error maps to ErrUnsupported; an over-limit input to

@@ -0,0 +113,4 @@
+
+	// Check dimensions BEFORE a full decode, so a decompression bomb is refused
+	// before it allocates its bitmap.
+	cfg, format, err := image.DecodeConfig(bytes.NewReader(raw))

@@ -0,0 +117,4 @@
+	if err != nil {
+		return nil, "", ErrUnsupported
+	}
+	if int64(cfg.Width)*int64(cfg.Height) > maxDecodePixels {

@@ -0,0 +121,4 @@
+		return nil, format, ErrTooLarge
+	}
+
+	img, _, err := image.Decode(bytes.NewReader(raw))

@@ -0,0 +151,4 @@
+	}
+	scale := float64(maxDim) / float64(longest)
+	nw, nh := max(int(float64(w)*scale), 1), max(int(float64(h)*scale), 1)
+	dst := image.NewRGBA(image.Rect(0, 0, nw, nh))

@@ -0,0 +86,4 @@
+// longest edge with aspect ratio preserved, and a small one is left alone.
+func TestNormalizeDownscales(t *testing.T) {
+	// 4000x1000 → longest 4000, MaxDim 2048 → scaled to 2048x512.
+	big := pngBytes(t, 4000, 1000)

@@ -0,0 +108,4 @@
+	if err != nil {
+		t.Fatalf("Normalize small: %v", err)
+	}
+	cfg, _, _ = image.DecodeConfig(bytes.NewReader(out))

@@ -0,0 +124,4 @@
+	}
+}
+
+// TestNormalizeRejectsBombDimensions: a small file claiming a huge canvas is