fix: require client secrets and sanitize uploaded images

.env.example

@@ -2,6 +2,7 @@ ADMIN_SECRET=replace-with-a-long-random-secret
 DB_PATH=./data/proxy.db
 MAX_UPLOAD_BYTES=52428800
 MAX_IMAGES=8
+MAX_IMAGE_PIXELS=25000000
 HTTP_TIMEOUT_SECONDS=300
 CONNECT_TIMEOUT_SECONDS=15
 ALLOWED_ORIGINS=