Upload a product image (multipart)

Story 5 AC-5.5. Multipart upload of a single image part named `image`. Request body is capped at **5 MiB** via `http.MaxBytesReader` BEFORE the multipart parser runs; oversize bodies return 413 `image_too_large`. Accepted content types (closed set): `image/png`, `image/jpeg`, `image/webp` — anything else returns 415 `unsupported_media_type`. The client-supplied filename is sanitized via `filepath.Base` to prevent path traversal; the storage key is server-derived as `products/<tenant_id>/<product_id>.<ext>` so the client cannot influence object names. Persists `image_url` on the product row in the same tenant tx and broadcasts a `product.image_updated` CatalogStreamEvent. Gated by `pos.catalog.write`.

curl -X POST "https://example.com/api/pos/v1/catalog/products/497f6eca-6276-4993-bfeb-53cbbbba6f08/image" \  -F image="string"

{
  "id": "018f4d9f-7b8a-7c2d-9a2d-1f8b92f6d101",
  "image_url": "https://cdn.505pay.link/products/018f4d9f-7b8a-7c2d-9a2d-1f8b92f6d000/018f4d9f-7b8a-7c2d-9a2d-1f8b92f6d101.png"
}

{
  "error": "string",
  "message": "string",
  "request_id": "string"
}

{
  "error": "string",
  "message": "string",
  "request_id": "string"
}

{
  "error": "string",
  "message": "string",
  "request_id": "string"
}

{
  "error": "string",
  "message": "string",
  "request_id": "string"
}

{
  "error": "string",
  "message": "string",
  "request_id": "string"
}

{
  "error": "string",
  "message": "string",
  "request_id": "string"
}

{
  "error": "string",
  "message": "string",
  "request_id": "string"
}