fix: inspect uploaded image dimensions on the server

docs/API.md

@@ -123,9 +123,10 @@ an available listing to `CLOSED`; pending changes are available from draft or
 available listings.
 
 `POST /api/v1/admin/inventory/:id/images` stores validated image metadata for an
-owned physical inventory item. File bytes are handled by the future
+owned physical inventory item. File bytes are handled through the
 `ImageStorage` adapter; JSON metadata and multipart image uploads are accepted.
-Multipart uploads require `width` and `height` fields and validate the binary
+Multipart uploads derive dimensions from image bytes; supplied `width` and
+`height` fields are ignored. They validate the binary
 signature before storage. Publication counts persisted inventory images rather
 than trusting a listing request field.
 
@@ -218,3 +219,9 @@ Image update payloads are strict:
 Malformed, missing, mistyped, oversized, or extra fields return
 `400 VALIDATION_ERROR` without a persistence write. The service also enforces
 these constraints for non-HTTP callers. Existing ownership and CSRF checks apply.
+
+
+Multipart image uploads inspect and decode JPEG/PNG/WebP bytes before storage.
+Responses contain measured width/height and actual byte size. Invalid decoding
+returns `400 IMAGE_DECODE_INVALID`; existing file-size, signature and dimension
+limits remain enforced. The JSON metadata-registration path is unchanged.