ImageId Format Injection in Image Upload Endpoint

I found an input validation issue in the image upload endpoint that lets me inject special characters into the `rel` parameter. This breaks the expected ImageId format that the application uses to identify uploaded images. While testing upload functionality, I noticed that colon characters aren't …

val image = PicfitImage(
  id = ImageId(s"$rel:${ThreadLocalRandom.nextString(8)}.$extension"),
  // rel parameter used directly without validation
  rel = rel,
  // ...
)