feat: add multipart image uploads

Register Fastify multipart support, validate JPEG/PNG/WebP binary signatures, store upload bytes through ImageStorage, persist metadata after storage succeeds, clean up bytes on metadata failure, and document the upload boundary. Verification: npm test passed 68 tests and integration passed 14 tests. No build script is configured.

apps/api/src/modules/inventory/routes/admin-image-routes.js

@@ -1,5 +1,6 @@
 import { toAdminInventoryImageDto } from '@pokemon-inventory/contracts/image';
 import { createInventoryImageSchema } from '@pokemon-inventory/validation/image';
+import { randomUUID } from 'node:crypto';
 
 import { createApplicationError } from '../../../shared/errors/application-error.js';
 
@@ -32,6 +33,39 @@ export async function registerAdminImageRoutes(app, options) {
       request.headers['x-csrf-token'],
     );
 
+    if (request.isMultipart()) {
+      const part = await request.file();
+      if (!part) {
+        throw createApplicationError('IMAGE_FILE_REQUIRED', 'An image file is required.', 400);
+      }
+
+      const data = await part.toBuffer();
+      const fields = part.fields;
+      const originalFilename = part.filename;
+      const result = createInventoryImageSchema.safeParse({
+        storageKey: `inventory/${request.params.id}/${randomUUID()}`,
+        originalFilename,
+        mimeType: part.mimetype,
+        fileSize: data.length,
+        width: Number(fields.width?.value),
+        height: Number(fields.height?.value),
+        altText: fields.altText?.value,
+        sortOrder: fields.sortOrder ? Number(fields.sortOrder.value) : undefined,
+        isPrimary: fields.isPrimary?.value === 'true',
+      });
+
+      if (!result.success) return validationError(reply, result);
+
+      const image = await inventoryImageService.upload({
+        ...result.data,
+        data,
+        inventoryItemId: request.params.id,
+        sellerId: admin.sellerId,
+      });
+
+      return reply.code(201).send({ data: toAdminInventoryImageDto(image) });
+    }
+
     const result = createInventoryImageSchema.safeParse(request.body);
     if (!result.success) return validationError(reply, result);