feat: add multipart image uploads

Register Fastify multipart support, validate JPEG/PNG/WebP binary signatures, store upload bytes through ImageStorage, persist metadata after storage succeeds, clean up bytes on metadata failure, and document the upload boundary. Verification: npm test passed 68 tests and integration passed 14 tests. No build script is configured.

apps/api/tests/domain/inventory-image.test.js

@@ -1,7 +1,10 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 
-import { validateInventoryImageMetadata } from '../../src/modules/inventory/domain/inventory-image.js';
+import {
+  validateImageSignature,
+  validateInventoryImageMetadata,
+} from '../../src/modules/inventory/domain/inventory-image.js';
 
 const validImage = {
   mimeType: 'image/jpeg',
@@ -27,4 +30,22 @@ test('rejects unsupported MIME types, oversized files, and oversized dimensions'
     () => validateInventoryImageMetadata({ ...validImage, width: 10001 }),
     (error) => error.code === 'IMAGE_DIMENSIONS_INVALID',
   );
+});
+
+test('accepts matching image signatures and rejects mismatched bytes', () => {
+  assert.equal(
+    validateImageSignature(Buffer.from([0xff, 0xd8, 0xff, 0x00]), 'image/jpeg'),
+    true,
+  );
+  assert.equal(
+    validateImageSignature(
+      Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+      'image/png',
+    ),
+    true,
+  );
+  assert.throws(
+    () => validateImageSignature(Buffer.from('not-an-image'), 'image/png'),
+    (error) => error.code === 'IMAGE_SIGNATURE_INVALID',
+  );
 });