Implement Image Uploads for UEditor 1.3.6

UEditor's upload dialog sends a multipart request and expects a response in the editor's documented JSON format. The backend must match the field name and action used by the selected UEditor version.

A successful response commonly contains fields such as:

{
  "state": "SUCCESS",
  "url": "/uploads/2026/07/image.png",
  "title": "image.png",
  "original": "original.png",
  "type": ".png",
  "size": 12345
}

Generate the stored filename on the server instead of trusting the submitted name. Normalize and validate paths, restrict file size and count, inspect actual content, and store uploads outside executable application directories.

The public URL and filesystem path are different concepts; map them explicitly. Return UTF-8 JSON with the expected content type and inspect the browser network panel when the editor reports a generic upload failure.

UEditor 1.3.6 is old software. Before exposing it publicly, review known security issues, authentication, CSRF protection, upload authorization, image re-encoding, and whether migration to a maintained editor is more appropriate.