fix: harden public image serving

[Zhenvip]

Closes #1

Summary

• add a small public image path resolver that rejects malformed paths and directory traversal
• use it before streaming files from public/images so requests cannot escape the image root
• make npm test run the new Node test suite and document basic development commands
• honor PORT when starting the server

Verification

• npm test
• node --check server.js && node --check lib/static-images.js && node --check lib/fileserver.js
• git diff --check HEAD~1 HEAD