fix: require client secrets and sanitize uploaded images

docs/API.md

@@ -1,6 +1,6 @@
 # phproxy API
 
-Base URL on this machine's Tailscale network: `http://100.67.41.125:8080`
+Production base URL: `https://ph_proxy.sokaris.link` (local development uses `http://127.0.0.1:8000`).
 
 The service accepts `multipart/form-data` for generation. Management routes also accept form data. Responses are JSON unless noted. The examples use `curl`; an agent can translate them to Python `requests` or `httpx`.
 
@@ -11,13 +11,13 @@ There are two kinds of credentials:
 - **Admin secret**: configured by the service operator. Send it as `x-admin-secret` to administrator endpoints, or `auth-secret` to provider-key endpoints.
 - **Client secret**: configured when creating a client. Send it as `x-client-secret` when generating or polling. It can also be used as `auth-secret` for that client's provider-key endpoints.
 
-For the current local development server, the temporary admin secret is `local-development-admin-secret`. Replace it before using the service with real API keys or outside a trusted development tailnet.
+Set `ADMIN_SECRET` in the service environment. Do not commit it or include it in client scripts.
 
 Create a client:
 
 ```sh
-BASE_URL=http://100.67.41.125:8080
-ADMIN_SECRET=local-development-admin-secret
+BASE_URL=https://ph_proxy.sokaris.link
+ADMIN_SECRET='value-from-the-service-environment'
 
 curl -sS -X POST "$BASE_URL/api/admin/client" \
   -H "x-admin-secret: $ADMIN_SECRET" \
@@ -58,7 +58,7 @@ The same endpoint may be authorized with the owning client's secret instead of t
 | `params` | No | JSON object encoded as a string. Defaults to `{}`. |
 | `images` | No | Repeat this multipart field for each reference image. |
 
-Send `x-client-secret` if the client has a secret configured. The service accepts JPEG, PNG, WebP, and GIF images, up to 8 files and 50 MiB aggregate by default. Limits can be changed by the operator.
+`x-client-secret` is required for every generation and job-poll request. Clients without a configured secret are rejected. Uploads accept JPEG, PNG, or WebP only (not GIF or SVG), up to 8 files and 50 MiB aggregate by default. The service decodes and re-encodes each image before forwarding it, stripping metadata and non-image payloads, and rejects malformed images, mismatched MIME types, and images larger than 25 megapixels by default. Operators can tune the limits.
 
 ```sh
 curl -sS -X POST "$BASE_URL/v1/generate" \
@@ -150,7 +150,7 @@ Provider APIs may reject unsupported parameters or model IDs. Configure exact ID
 | `GET /ui` | Network access control | Basic HTML administration page. |
 | `GET /api/admin/state` | `x-admin-secret` | Lists clients and keys with only a short key preview. |
 | `GET /api/admin/generations?limit=100` | `x-admin-secret` | Returns aggregate totals, per-client totals, and recent generation timing/cost records (limit 1–200). |
-| `POST /api/admin/client` | `x-admin-secret` | Form fields: `client_id`, `name`, optional `client_secret`; creates or updates a client. |
+| `POST /api/admin/client` | `x-admin-secret` | Form fields: `client_id`, `name`, and required `client_secret` (16–256 characters); creates or updates a client. |
 | `POST /api/keys` | `auth-secret` | Form fields: `client_id`, `provider`, `api_key`, optional `priority`. Admin or owning client may add keys. |
 | `DELETE /api/keys/{key_id}` | `auth-secret` | Deletes a key owned by the authenticated admin/client. |
 
@@ -162,10 +162,10 @@ Validation and authorization failures use FastAPI's `{"detail":"..."}` response
 | --- | --- |
 | `400` | Invalid parameters, provider, or missing provider keys. |
 | `401` | Missing or invalid admin/client secret. |
-| `403` | Client is unknown or inactive. |
+| `403` | Client is unknown, inactive, or has no secret configured. |
 | `404` | Client/key/job was not found, or the job belongs to another client. |
 | `413` | Request or image upload exceeds configured limits. |
-| `415` | Unsupported image MIME type. |
+| `415` | Unsupported, malformed, or MIME-mismatched image. |
 | `502` | Upstream failure after applicable failover attempts. Response contains status metadata, not upstream response bodies. |
 
 ## Notes for test scripts