feat: add image upload route with SSRF protection and form-data handling
