feat: add multipart image uploads

Register Fastify multipart support, validate JPEG/PNG/WebP binary signatures, store upload bytes through ImageStorage, persist metadata after storage succeeds, clean up bytes on metadata failure, and document the upload boundary. Verification: npm test passed 68 tests and integration passed 14 tests. No build script is configured.

apps/api/tests/http/listing-routes.test.js

@@ -71,6 +71,16 @@ function createTestApp({ authenticateAdmin, authorizeUnsafeRequest, listing } =
           updatedAt: new Date('2026-09-08T00:00:00.000Z'),
         };
       },
+      async upload(input) {
+        return {
+          id: 'image-upload-1',
+          ...input,
+          data: undefined,
+          processingStatus: 'PENDING',
+          createdAt: new Date('2026-09-08T00:00:00.000Z'),
+          updatedAt: new Date('2026-09-08T00:00:00.000Z'),
+        };
+      },
     },
   });
 
@@ -198,3 +208,45 @@ test('adds inventory image metadata for the authenticated seller', async (testCo
   assert.equal(response.json().data.inventoryItemId, 'inventory-1');
   assert.equal(response.json().data.processingStatus, 'PENDING');
 });
+
+test('accepts a multipart image upload and forwards validated fields', async (testContext) => {
+  const app = createTestApp({
+    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
+  });
+  testContext.after(() => app.close());
+
+  const boundary = 'pokemon-image-boundary';
+  const prefix = [
+    `--${boundary}`,
+    'Content-Disposition: form-data; name="width"',
+    '',
+    '1200',
+    `--${boundary}`,
+    'Content-Disposition: form-data; name="height"',
+    '',
+    '900',
+    `--${boundary}`,
+    'Content-Disposition: form-data; name="file"; filename="front.jpg"',
+    'Content-Type: image/jpeg',
+    '',
+  ].join('\r\n');
+  const suffix = `\r\n--${boundary}--\r\n`;
+  const payload = Buffer.concat([
+    Buffer.from(`${prefix}\r\n`),
+    Buffer.from([0xff, 0xd8, 0xff, 0x00]),
+    Buffer.from(suffix),
+  ]);
+
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/inventory/inventory-1/images',
+    headers: {
+      'content-type': `multipart/form-data; boundary=${boundary}`,
+    },
+    payload,
+  });
+
+  assert.equal(response.statusCode, 201);
+  assert.equal(response.json().data.id, 'image-upload-1');
+  assert.equal(response.json().data.originalFilename, 'front.jpg');
+});