Storage hardening: signed direct uploads, image resizing, and malware scanning

Context: Uploads currently route bytes through the Node server with service-role writes (src/app/api/uploads). Migration 0022 flagged signed upload URLs, image resizing, and virus scanning as a follow-up.

Scope:

• Signed direct-to-Storage upload URLs so large files skip the app server.
• Server-side image resizing and thumbnails for avatars and inline media.
• A malware/content scanning step before a file becomes public.

Done when: large media uploads do not pass through the Node process; resized variants are served; unsafe files are rejected.