fix(upload): register validateImageBuffer magic-byte check on upload route

[singhanurag0317-bit]

🐛 Fix: validateImageBuffer middleware was defined but never registered on the upload route

Fixes #815

Problem

validateImageBuffer in upload.middleware.js verifies file magic bytes, but it was never registered in upload.routes.js. Attackers could upload non-image payloads simply by renaming the extension to .png.

Change

• backend/src/routes/upload.routes.js: registered validateImageBuffer in the single-photo upload pipeline — uploadSinglePhotoOrFile → validateImageBuffer → validateImageChain → uploadPhoto. Non-image payloads are now rejected with HTTP 400 (and the temp file is removed) before any further processing.

Tests

• New backend/src/__tests__/uploadValidation.test.js (2 integration tests via supertest):
  • rejects an HTML payload renamed to evil.png (magic-byte mismatch → 400),
  • accepts a real PNG image (→ 200).

Verification

• npm test in backend/ — 11 suites, 32 tests, all passing.

[vercel]

@singhanurag0317-bit is attempting to deploy a commit to the souma9830's projects Team on Vercel.

A member of the Team first needs to authorize it.