fix: harden upstream path + binary-body validation (gadfly round 1)

- upstreamPath rejects '..' in model ids AND in the rest path — the rest
  can embed SERVER-SUPPLIED components (ACE-Step result file URLs), so
  dot-dot/scheme smuggling toward other proxy endpoints is refused
- singleImageResult requires positive image evidence (sniffed magic OR
  declared image/*): an empty-Content-Type error page can no longer pass
  as 'the image' via sniffImageMIME's PNG-default labelling
- upscale/background responses get a dedicated 256MB cap (the 64MB cap
  is JSON-sized; a 4x PNG legitimately exceeds it)
- mesh JSON-detection widened (512-byte whitespace-tolerant peek + reject
  declared application/json)
- Transcribe now reuses buildMultipart; transcriptionFilename takes
  (filename, mime) so diarize shares it without a fake request struct;
  truncateForError stops shadowing builtin cap; OnlyMask doc de-ambiguated

Co-Authored-By: Claude Fable 5 <[email protected]>

provider/llamaswap/upstream.go

@@ -21,12 +21,19 @@ func upstreamPath(model, rest string) (string, error) {
 	if strings.TrimSpace(model) == "" {
 		return "", fmt.Errorf("llama-swap: upstream call requires a model id")
 	}
-	if strings.ContainsAny(model, "/?#") {
+	if strings.ContainsAny(model, "/?#") || strings.Contains(model, "..") {
 		return "", fmt.Errorf("llama-swap: invalid model id %q for upstream call (contains a path separator)", model)
 	}
 	if !strings.HasPrefix(rest, "/") {
 		rest = "/" + rest
 	}
+	// rest may embed SERVER-SUPPLIED components (e.g. ACE-Step's result
+	// file URL) — refuse dot-dot segments and absolute-URL smuggling so a
+	// hostile/buggy upstream cannot redirect the follow-up request at
+	// another proxy endpoint (/api/models/unload, ...).
+	if strings.Contains(rest, "..") || strings.Contains(rest, "://") {
+		return "", fmt.Errorf("llama-swap: invalid upstream path %q (dot-dot or scheme)", rest)
+	}
 	return "/upstream/" + model + rest, nil
 }