security: authorize and validate presigned upload requests

POST /api/v1/uploads minted an upload key from caller input with no
ownership check, no content-type allowlist, and the raw filename
interpolated into the S3 key.

- Ownership: a caller may only mint upload URLs for a route/activity
  they own, enforced via the branded loadOwnedRoute/loadOwnedActivity
  (404 on miss, no existence leak). Closes writing into another
  user's resource key-space.
- Content type: the request schema now constrains contentType to an
  image/gpx allowlist, so active content (HTML/SVG/JS) that would
  execute if served inline is rejected at the request boundary.
- Filename: sanitizeUploadFilename() reduces the client filename to a
  safe basename (charset-restricted, no path components, no leading
  dots, length-bounded) before it becomes part of the key.

Tests: schema allow/deny + filename sanitization in @trails-cool/api;
handler tests covering owned-success, not-owner 404, disallowed
content-type, and the route-vs-activity ownership branch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/api/src/uploads.ts

@@ -1,12 +1,40 @@
 import { z } from "zod";
 
+/**
+ * Content types accepted for uploads. Constrained so a caller can't
+ * stash active content (HTML/SVG/JS) that would execute if the object
+ * were ever served inline. Keep in sync with what the upload UI sends.
+ */
+export const ALLOWED_UPLOAD_CONTENT_TYPES = [
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/gif",
+  "application/gpx+xml",
+] as const;
+
 export const PresignedUploadRequestSchema = z.object({
-  filename: z.string(),
-  contentType: z.string(),
+  filename: z.string().min(1).max(255),
+  contentType: z.enum(ALLOWED_UPLOAD_CONTENT_TYPES),
   resourceType: z.enum(["route", "activity"]),
   resourceId: z.uuid(),
 });
 
+/**
+ * Reduce a client-supplied filename to a safe S3 object-key segment:
+ * basename only (drop any path), restrict to a conservative charset,
+ * collapse runs, strip leading dots, and bound the length. Never empty.
+ */
+export function sanitizeUploadFilename(filename: string): string {
+  const base = filename.split(/[/\\]/).pop() ?? "";
+  const cleaned = base
+    .replace(/[^A-Za-z0-9._-]/g, "_")
+    .replace(/_{2,}/g, "_")
+    .replace(/^\.+/, "")
+    .slice(0, 128);
+  return cleaned.length > 0 ? cleaned : "upload";
+}
+
 export const PresignedUploadResponseSchema = z.object({
   uploadUrl: z.url(),
   storageKey: z.string(),