fix: harden image paths and upload ids

[exal-gh-33]

Closes #1.

Summary

• Keep public image requests inside public/images by resolving and validating requested paths.
• Validate collection ids before listing photos or accepting uploads.
• Reject missing uploads with a clear 400 response.
• Add focused regression tests for collection id validation and path traversal protection.
• Replace the placeholder test script with a runnable node --test command.

Validation

• Passed: node --test test/request-guards.test.js
• Passed: node --check server.js lib/request-guards.js test/request-guards.test.js
• Passed: git diff --check

Pvium bounty: #1

[exal-gh-33]

Payout address for the Pvium 5 USDC bounty: 0x292284555091e15E5c6B7466EB660a6B6Fa46779.