fix: validate image order and alt text updates

docs/API.md

@@ -207,3 +207,14 @@ successful no-op. Missing/unowned images return `404 IMAGE_NOT_FOUND`; invalid
 bodies return `400 VALIDATION_ERROR`. The response uses the existing admin image
 DTO. The legacy absolute `/order` endpoint remains available, but UI moves use
 this new operation exclusively.
+
+Image update payloads are strict:
+- `PATCH /api/v1/admin/images/:id/order` requires exactly `sortOrder`, an integer
+  from 0 through 2147483647 (the stored PostgreSQL integer range).
+- `PATCH /api/v1/admin/images/:id/alt-text` requires exactly `altText`, either
+  trimmed text up to 1,000 characters or explicit `null`. An empty string clears
+  the text; omission no longer implicitly clears it.
+
+Malformed, missing, mistyped, oversized, or extra fields return
+`400 VALIDATION_ERROR` without a persistence write. The service also enforces
+these constraints for non-HTTP callers. Existing ownership and CSRF checks apply.