add server side validation of image URLs

[rbentcw]

Link to Issue

Closes: Internal

Title: Add server-side image URL validation to command schemas

Summary

• Adds a reusable ImageUrl Zod schema that validates image URLs using the existing
  isValidImageUrl() utility (HTTPS + image extension, data:image/, or ipfs://)
• Applies ImageUrl validation to all 15 image URL fields across command schemas
  (communities, users, contests, quests, tokens, bot-contest, magic login)
• Adds a domain allowlist to checkIconSize() so it only fetches from
  assets.commonwealth.im and s3.us-east-1.amazonaws.com

Details

Previously, most image URL fields in command schemas accepted bare z.string() with no format
validation. The client already used isValidImageUrl() for rendering guards, but the server
accepted anything. This brings server-side validation in line with the client.

Only command schemas (write path) are changed. Entity and query schemas (read path) are
untouched to avoid breaking reads of existing data.

Test plan

• pnpm -F @hicommonwealth/schemas check-types passes
• Verify image upload flows still work (community icon, user avatar, contest image, quest
  image)
• Verify data:image/ and ipfs:// URLs are accepted
• Verify non-image URLs are rejected at the API layer