Rework app configuration and image serving

[aiautotool]

Closes #1

Summary

• move repeated form-body parsing and JSON/error responses into small HTTP helpers
• make MySQL connection and server port configurable through environment variables
• harden /public/images/* serving against malformed paths and directory traversal while returning proper image content types
• validate required request fields for login/collection endpoints instead of falling through or crashing
• add a focused regression test for image path resolution and document local development commands

Verification

• npm test
• node --check server.js && node --check lib/http.js && node --check lib/static-images.js && node --check lib/fileserver.js
• git diff --check