upload: decode images in a throwaway child process and tighten input checks

Malformed HEIF uploads were corrupting the heap inside libvips/libheif and
taking the whole app down with them, since sharp ran in-process. Move the
decode into a per-upload child (lib/image-worker.ts, spawned by lib/image.ts
with a hard timeout) so a decoder crash fails one request instead of the
server, and never load sharp in the main process.

Also: only accept jpeg/png/webp/gif as sniffed by file-type instead of any
image/* subtype, decode with failOnError and a pixel cap, refuse uploads
from blacklisted accounts (a freeze previously only blocked sends), and
rate-limit uploads per account.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

0 files changed, 0 insertions, 0 deletions