feat: validate inventory image metadata

Centralize supported MIME type, 10 MiB file-size, and 10,000-pixel dimension limits in the inventory image service boundary. Add domain coverage and update image/status documentation. Verification: npm test passed 64 tests and integration passed 14 tests. No build script is configured.

apps/api/src/modules/inventory/domain/inventory-image.js

@@ -0,0 +1,31 @@
+import { createApplicationError } from '../../../shared/errors/application-error.js';
+
+const SUPPORTED_MIME_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp']);
+const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+const DEFAULT_MAX_DIMENSION = 10_000;
+
+export function validateInventoryImageMetadata(
+  image,
+  { maxFileSize = DEFAULT_MAX_FILE_SIZE, maxDimension = DEFAULT_MAX_DIMENSION } = {},
+) {
+  if (!SUPPORTED_MIME_TYPES.has(image.mimeType)) {
+    throw createApplicationError('IMAGE_MIME_TYPE_UNSUPPORTED', 'Image MIME type is not supported.', 400);
+  }
+
+  if (!Number.isInteger(image.fileSize) || image.fileSize <= 0 || image.fileSize > maxFileSize) {
+    throw createApplicationError('IMAGE_FILE_TOO_LARGE', 'Image file size is invalid or too large.', 400);
+  }
+
+  if (
+    !Number.isInteger(image.width) ||
+    !Number.isInteger(image.height) ||
+    image.width <= 0 ||
+    image.height <= 0 ||
+    image.width > maxDimension ||
+    image.height > maxDimension
+  ) {
+    throw createApplicationError('IMAGE_DIMENSIONS_INVALID', 'Image dimensions are invalid or too large.', 400);
+  }
+
+  return true;
+}

apps/api/src/modules/inventory/services/inventory-image-service.js

@@ -1,8 +1,10 @@
 import { createApplicationError } from '../../../shared/errors/application-error.js';
+import { validateInventoryImageMetadata } from '../domain/inventory-image.js';
 
 export function createInventoryImageService({ inventoryImageRepository }) {
   return {
     async create(input) {
+      validateInventoryImageMetadata(input);
       const image = await inventoryImageRepository.createForSeller(
         { ...input, processingStatus: 'PENDING' },
         input.sellerId,