fix: harden upstream path + binary-body validation (gadfly round 1)

- upstreamPath rejects '..' in model ids AND in the rest path — the rest
  can embed SERVER-SUPPLIED components (ACE-Step result file URLs), so
  dot-dot/scheme smuggling toward other proxy endpoints is refused
- singleImageResult requires positive image evidence (sniffed magic OR
  declared image/*): an empty-Content-Type error page can no longer pass
  as 'the image' via sniffImageMIME's PNG-default labelling
- upscale/background responses get a dedicated 256MB cap (the 64MB cap
  is JSON-sized; a 4x PNG legitimately exceeds it)
- mesh JSON-detection widened (512-byte whitespace-tolerant peek + reject
  declared application/json)
- Transcribe now reuses buildMultipart; transcriptionFilename takes
  (filename, mime) so diarize shares it without a fake request struct;
  truncateForError stops shadowing builtin cap; OnlyMask doc de-ambiguated

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

imagegen/background.go

@@ -15,9 +15,9 @@ type BackgroundRemovalRequest struct {
 	Net string
 
 	// OnlyMask returns the black/white segmentation mask instead of the
-	// cutout — white where the subject is. Useful as an inpainting mask
-	// (EditRequest.Mask semantics after inversion: the mask marks the
-	// FOREGROUND, an inpaint mask marks the region to REPAINT).
+	// cutout — WHITE marks the SUBJECT. To inpaint (repaint) the subject,
+	// use it directly as EditRequest.Mask; to repaint the BACKGROUND,
+	// invert it first (EditRequest.Mask is white-means-repaint).
 	OnlyMask bool
 }