fix: address gadfly review — filename sanitization, truncation guard, shared plumbing

- Transcribe: sanitize the caller-supplied multipart filename (CR/LF
  would inject Content-Disposition headers; upload metadata is
  untrusted), always send the required model/response_format fields,
  parse MIME parameters before extension matching, and give audio/opus
  its own .opus extension.
- doRaw: a response larger than maxResponseBytes is now an error, not a
  silent truncation.
- Shared plumbing: requireBaseURL() + newRequest() helpers replace the
  7x-duplicated guard/error string and the triplicated request
  building across doJSON/doRaw/Health.
- Health: non-2xx now returns *llm.APIError (package convention,
  programmatically distinguishable from transport failure) instead of
  a one-off unexported error type.
- Speak: reject negative Speed; speechMIME no longer accepts video/*
  Content-Types.
- image.go: Generate/Edit share one sdWire validate+map helper.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01AXQxVhXBw8PwFAtsVrXSmj

provider/llamaswap/health.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+
+	"gitea.stevedudenhoeffer.com/steve/majordomo/llm"
 )
 
 // Health reports whether the llama-swap instance is reachable (GET
@@ -13,16 +15,17 @@ import (
 // request will take (a cold model swap can still block for minutes). Bound
 // the probe with a short context deadline; the client has no timeout by
 // design.
+//
+// Failure taxonomy matches the rest of the package: transport failures wrap
+// the raw net error; a reachable-but-unhealthy status comes back as
+// *llm.APIError, so callers can errors.As-distinguish the two.
 func (p *Provider) Health(ctx context.Context) error {
-	if p.baseURL == "" {
-		return fmt.Errorf("llama-swap provider %q: no base URL configured (set one via WithBaseURL or an LLM_* env DSN)", p.name)
+	if err := p.requireBaseURL(); err != nil {
+		return err
 	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, p.baseURL+"/health", nil)
+	req, err := p.newRequest(ctx, http.MethodGet, "/health", "", nil)
 	if err != nil {
-		return fmt.Errorf("llama-swap: build request: %w", err)
-	}
-	if p.token != "" {
-		req.Header.Set("Authorization", "Bearer "+p.token)
+		return err
 	}
 	resp, err := p.client.Do(req)
 	if err != nil {
@@ -31,15 +34,11 @@ func (p *Provider) Health(ctx context.Context) error {
 	defer resp.Body.Close()
 	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 1<<10))
 	if resp.StatusCode/100 != 2 {
-		return &apiHealthError{status: resp.StatusCode}
+		return &llm.APIError{
+			Provider: p.name,
+			Status:   resp.StatusCode,
+			Message:  "health endpoint returned a non-2xx status",
+		}
 	}
 	return nil
 }
-
-// apiHealthError distinguishes "reachable but unhealthy" from transport
-// failure without pulling in the llm error taxonomy for a probe.
-type apiHealthError struct{ status int }
-
-func (e *apiHealthError) Error() string {
-	return fmt.Sprintf("llama-swap: health endpoint returned status %d", e.status)
-}