feat(phase1): add image storage utilities

- Create backend/services/image_storage.py with 4 core functions:
  - sanitize_filename(): remove unsafe chars, limit to 255 chars, convert to lowercase
  - get_unique_filename(): handle collisions with UUID suffix (format: {name}_{uuid8}_{variant}.jpg)
  - ensure_image_directories(): create /images/ root and category subdirs on startup
  - save_image(): save bytes to /images/{category}/{filename}, returns relative path
- Create comprehensive test suite (22 tests) covering all functionality
- Integrate ensure_image_directories() into FastAPI startup event
- Directory structure: /images/{category}/{filename}
- Collision handling: auto-suffix with UUID if filename exists
- All tests passing, pathlib.Path for safe operations

venv/lib/python3.12/site-packages/slowapi/util.py

@@ -0,0 +1,27 @@
+from starlette.requests import Request
+
+
+def get_ipaddr(request: Request) -> str:
+    """
+    Returns the ip address for the current request (or 127.0.0.1 if none found)
+     based on the X-Forwarded-For headers.
+     Note that a more robust method for determining IP address of the client is
+     provided by uvicorn's ProxyHeadersMiddleware.
+    """
+    if "X_FORWARDED_FOR" in request.headers:
+        return request.headers["X_FORWARDED_FOR"]
+    else:
+        if not request.client or not request.client.host:
+            return "127.0.0.1"
+
+        return request.client.host
+
+
+def get_remote_address(request: Request) -> str:
+    """
+    Returns the ip address for the current request (or 127.0.0.1 if none found)
+    """
+    if not request.client or not request.client.host:
+        return "127.0.0.1"
+
+    return request.client.host