fix: review findings — NaN threshold guard, percent-escape rejection in upstream model ids

- Segment: reject NaN thresholds (NaN fails every comparison, so it
  passed the [0,1] range check and reached the shim as the literal
  string "NaN"); ±Inf were already caught by the range comparisons,
  now covered by tests too.
- upstreamPath: reject '%' in model ids — %2F/%2E%2E percent-escapes
  decode back into path structure server-side, bypassing the literal
  /?#/.. rejection. Ids never legitimately contain '%'.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WWCQcYStWXBYUy5sZWnbLT

provider/llamaswap/segment.go

@@ -14,6 +14,7 @@ package llamaswap
 import (
 	"context"
 	"fmt"
+	"math"
 	"net/http"
 	"strconv"
 
@@ -45,7 +46,9 @@ func (m *segmentationModel) Segment(ctx context.Context, req imagegen.Segmentati
 	if req.Prompt == "" {
 		return nil, fmt.Errorf("%w: segmentation requires a prompt", llm.ErrUnsupported)
 	}
-	if req.Threshold < 0 || req.Threshold > 1 {
+	// NaN fails every comparison, so it would sail through a bare range
+	// check and reach the upstream as the literal string "NaN".
+	if math.IsNaN(req.Threshold) || req.Threshold < 0 || req.Threshold > 1 {
 		return nil, fmt.Errorf("%w: segmentation threshold must be in [0,1], got %g", llm.ErrUnsupported, req.Threshold)
 	}
 	path, err := upstreamPath(m.id, "/v1/segment")