An image is checked before it is decoded

An upload went straight to libvips: whatever loader recognised the bytes ran (an SVG sent as image/png was rasterised),
nothing bounded how many pixels it would decode to (a small PNG could decode to gigabytes, three times over), a GIF
was loaded frame by frame and never resized, and all of it ran inside the request with nothing limiting how many at
once. A GIF was typed gifv but stayed a .gif, which a gifv player can't play; its metadata was kept; colours lost
their ICC profile without being converted; HEIC was advertised but the bundled libvips can't decode it.

Now:
- only libvips' JPEG, PNG, GIF, WebP and HEIF loaders ever run on an upload (every other loader is blocked);
- the header alone says how big an image would decode, refused above Media:MaxPixels (40 MP) or MaxFrames;
- a still image is shrunk on load, turned by its orientation and brought into sRGB (thumbnail), then written without
  metadata, a profile picture the same way;
- an animated GIF becomes a looping silent H.264 mp4 typed gifv, as on Mastodon (PostMedia.Kind keeps it a gifv),
  and a remote GIF is an image;
- processing runs Media:Concurrency at a time, and uploads have their own rate limit per credential;
- HEIC and HEIF are no longer offered.

Tests: only the upload formats load, the header tells the size, an SVG posing as a PNG and an image too large are
refused before decoding, an animated GIF becomes a gifv and a still one an image, HEIC isn't advertised. The media
scenarios against the pasture (GoToSocial, Mastodon, Misskey, Akkoma, Pixelfed, Smithereen, Vernissage, Castopod,
PeerTube) pass: 329 checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub/Api/Mastodon/Controllers/AccountsController.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.AspNetCore.Mvc;
 
 using MongoDB.Entities;
@@ -16,6 +17,7 @@ using PrivaPub.Models.Post;
 using PrivaPub.Models.Social;
 using PrivaPub.Models.User;
 using PrivaPub.StaticServices;
+using PrivaPub.Infrastructure;
 
 using PostEntity = PrivaPub.Models.Post.Post;
 
@@ -46,7 +48,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpGet("/api/v1/accounts/verify_credentials"), Scope("read:accounts")]
 		public async Task<IActionResult> VerifyCredentials(CancellationToken token) => Json(await _mapper.Local(Me, withSource: true, token));
 
-		[HttpPatch("/api/v1/accounts/update_credentials"), Scope("write:accounts"), RequestSizeLimit(20 * 1024 * 1024),
+		[HttpPatch("/api/v1/accounts/update_credentials"), Scope("write:accounts"), EnableRateLimiting(RateLimiting.Uploads), RequestSizeLimit(20 * 1024 * 1024),
 			RequestFormLimits(MultipartBodyLengthLimit = 20 * 1024 * 1024)]
 		public async Task<IActionResult> UpdateCredentials([FromServices] IMediaService media, CancellationToken token)
 		{

PrivaPub/Api/Mastodon/Controllers/MediaController.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.RateLimiting;
 using PrivaPub.Infrastructure.Statistics;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
@@ -7,6 +8,7 @@ using MongoDB.Entities;
 using PrivaPub.Api.Mastodon.Infrastructure;
 using PrivaPub.Domain.Media;
 using PrivaPub.Models.Media;
+using PrivaPub.Infrastructure;
 
 using System.Globalization;
 
@@ -28,7 +30,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			_ledger = ledger;
 		}
 
-		[HttpPost("/api/v1/media"), HttpPost("/api/v2/media"), Scope("write:media"), RequestSizeLimit(UploadLimit),
+		[HttpPost("/api/v1/media"), HttpPost("/api/v2/media"), Scope("write:media"), EnableRateLimiting(RateLimiting.Uploads), RequestSizeLimit(UploadLimit),
 			RequestFormLimits(MultipartBodyLengthLimit = UploadLimit)]
 		public async Task<IActionResult> Upload(CancellationToken token)
 		{

PrivaPub/Api/Mastodon/Mappers/MastodonMapper.cs

@@ -650,9 +650,9 @@ namespace PrivaPub.Api.Mastodon.Mappers
 		MediaAttachment Media(PostMedia media) => new()
 		{
 			Id = media.AttachmentId ?? media.Id.ToString("N"),
-			Type = media.ContentType switch
+			// a GIF is a gifv only once it is an mp4 (ours): a GIF itself is an image, which a gifv player can't play
+			Type = media.Kind == "gifv" ? "gifv" : media.ContentType switch
 			{
-				{ } type when type.StartsWith("image/gif") => "gifv",
 				{ } type when type.StartsWith("image/") => "image",
 				{ } type when type.StartsWith("video/") => "video",
 				{ } type when type.StartsWith("audio/") => "audio",