fix(security): harden uploads and wecom binding

backend/app/services/minio_client.py

@@ -1,4 +1,5 @@
 from datetime import timedelta
+from io import BytesIO
 from minio import Minio
 from app.config import settings
 
@@ -20,10 +21,16 @@ def get_minio_client() -> Minio:
     return _client
 
 
-def generate_presigned_upload_url(object_key: str, expires: int = 600) -> str:
-    """Generate a presigned PUT URL for direct upload to MinIO."""
+def put_validated_image(object_key: str, image_bytes: bytes) -> None:
+    """Store a normalized image only after the API has validated its content."""
     client = get_minio_client()
-    return client.presigned_put_object(settings.MINIO_BUCKET, object_key, expires=timedelta(seconds=expires))
+    client.put_object(
+        settings.MINIO_BUCKET,
+        object_key,
+        BytesIO(image_bytes),
+        length=len(image_bytes),
+        content_type="image/jpeg",
+    )
 
 
 def generate_presigned_download_url(object_key: str, expires: int = 3600) -> str: