feat: unified CCITT decoder with G3 2D, byte alignment, and resource limits

[lilith]

Draft PR addressing several open issues and feature gaps.

New: unified Decoder struct

A single Decoder configurable via DecodeOptions, replacing the need to choose between Group3Decoder and Group4Decoder at the type level. Maps directly to PDF CCITTFaxDecode parameters and TIFF Group3Options/Group4Options tags.

let opts = DecodeOptions {
    columns: 1728,
    rows: Some(2000),
    encoding: EncodingMode::Group3_2D { k: 4 },
    rows_are_byte_aligned: true,
    end_of_line: true,
    end_of_block: false,
    black_is_1: false,
    msb_first: true,
    limits: Some(Limits {
        max_pixels: Some(100_000_000),
        max_input_bytes: Some(10 * 1024 * 1024),
    }),
};
decode(data.iter().copied(), opts, |transitions| {
    // transitions are &[u32] — supports widths beyond u16::MAX
    for color in pels32(transitions, opts.columns) {
        // process pixel
    }
})?;

The existing decode_g3, decode_g4, Group3Decoder, and Group4Decoder are unchanged — fully backwards compatible.

New features

u32 transitions (partially addresses #13)

The unified decoder uses u32 internally for transitions and width, enabling images wider than 65535 pixels. Default Limits caps at u16::MAX range for safety — callers opt in by raising limits. Legacy API remains u16.

Group 3 2D decoding (addresses #5 G3 thread)

Mixed 1D/2D coding per T.4. Reads the tag bit after each EOL to select 1D or 2D decoding per line. The 2D path reuses the existing G4 mode-code logic. Tested with a real G3 2D image generated by libtiff's tiffcp -c g3:2d.

Byte-aligned mode (rows_are_byte_aligned)

Consumes padding bits between lines to reach the next byte boundary. Needed for TIFF Group3Options bit 2 and PDF EncodedByteAlign. Tested against Go's x/image/ccitt aligned test files — both G3 and G4 aligned variants now decode correctly.

EndOfBlock=false support

When end_of_block is false, the decoder uses rows to determine when to stop instead of requiring EOFB/RTC markers. Handles TIFF strips that end without termination markers.

EndOfLine=false support

G3 data without EOL markers between lines. Run-lengths terminate at columns width instead of requiring an EOL marker. Needed for some PDF streams.

LSB-first bit order (msb_first=false)

ByteReader::new_lsb() reverses bits within each input byte. For TIFF FillOrder=2.

Resource limits

Limits { max_pixels, max_input_bytes } rejects oversized images early and bounds input consumption. Returns DecodeError::LimitExceeded on violation. Default limits cap at u16 range.

Test coverage

9 new tests using Go's x/image/ccitt corpus (153×55 bw-gopher, BSD-3-Clause, 56KB):

• Legacy parity: unified G4 and G3 produce identical output to decode_g4/decode_g3
• Go corpus: G4 normal, G3 normal, G3/G4 pixel match, G4 aligned, G3 aligned
• G3 2D: 176×8 image from tiffcp -c g3:2d
• Limits: max_pixels rejects oversized dimensions

26 total tests pass (23 unit + 2 check + 1 errors).

What this doesn't address (yet)

• Increase image dimensions to u32? #13 full u32 migration: Legacy API still uses u16. Full migration (encoder, pels(), Transitions) is a separate breaking change.
• Avoid proc macro dependency #19 proc macro elimination: Orthogonal to this work.
• Rewriting legacy decoders as wrappers: Left as a follow-up to avoid risk.

Stacks on #24 (cargo fmt).