fix(upload): verify file signatures and reject image bombs for vehicle uploads

[vjuliaife]

Summary

Vehicle image uploads accepted the caller-provided Content-Type header and wrote bytes directly to storage without running the KYC-grade file signature checks. A file labeled as an image could contain another format, be a header-only MIME spoof, or declare pathological pixel dimensions (decompression bomb).

Changes

• lib/security/kyc-file-validation.ts: added per-format magic-byte dimension decoders for JPEG (SOF marker walk), PNG (IHDR chunk), and WebP (VP8/VP8L/VP8X chunks). Declared image formats are now checked against shared, exported bounds (MAX_IMAGE_DIMENSION_PX, MAX_IMAGE_PIXELS) and rejected when dimensions cannot be decoded (malformed/truncated) or exceed the bounds (decompression bomb).
• app/api/upload/route.ts: the vehicle upload branch now calls the shared file validator before writing bytes to Blob storage, mirroring the existing KYC branch, and logs a vehicle.image.upload.rejected audit event on rejection, consistent with the existing kyc.document.upload.rejected pattern.
• __tests__/lib/security/kyc-file-validation.test.ts: updated existing fixtures to include real, decodable image dimensions, and added coverage for truncated images, oversized dimensions, and decompression-bomb pixel counts, plus confirmation that PDF uploads are unaffected by the new checks.

Issues

Resolves #190

Verification

• Manual code review of the complete diff was performed; no unrelated files, snapshots, or generated files were touched.
• cargo build was not run.
• cargo test was not run.