Harden the image upload trust boundary

[fengting124]

What

• validate JPEG, PNG, and WebP from signatures plus a complete ImageIO decode
• enforce encoded byte, dimensions, and decoded pixel limits before accepted storage
• derive canonical MIME from content and separate display filenames from generated storage paths
• return deterministic 400/413 errors and document deployment controls

Why

Uploads are the platform's primary untrusted input and later feed the model runtime. The previous path trusted the browser MIME type, decoded without pixel limits, and wrote files before content validation.

Project-specific decision

Accepted evidence is not re-encoded because that would alter metadata and compression artifacts used by forensic analysis. Compensating controls include non-public generated storage, strict decoding, bounded resources, and no generic download route.

Verification

• Java: 116 tests passed
• frontend: 8 tests, lint, and production build passed
• model service: 6 tests passed without weights
• smoke tools: 3 tests passed
• WebP SPI verified with a TwelveMonkeys upstream fixture
• duplicate asset writes verified not to overwrite evidence on Windows