Block SVG uploads for storefront logos/covers/product images.

SVG can embed JavaScript and would run as stored XSS when served inline on a
public storefront page, and we have no SVG sanitizer. Allow only raster
formats:
- item_images validation: image rule (permits SVG) -> mimes:jpeg,jpg,png,gif,webp
- QrCodeManagerService: reject image/svg+xml / .svg(z) in brand-image and
  item-image storage (defense in depth, since those only checked the image/* prefix)
- file pickers: accept raster mimes only

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Http/Controllers/Merchant/StorefrontController.php

@@ -64,7 +64,7 @@ class StorefrontController extends Controller
             'menu_cover' => ['nullable', 'image', 'mimes:jpeg,jpg,png,gif,webp', 'max:8192'],
             'item_images' => ['nullable', 'array'],
             'item_images.*' => ['array'],
-            'item_images.*.*' => ['image', 'max:4096'],
+            'item_images.*.*' => ['mimes:jpeg,jpg,png,gif,webp', 'max:4096'],
         ]);
 
         $data = array_merge($request->all(), [
@@ -103,7 +103,7 @@ class StorefrontController extends Controller
             'menu_cover' => ['nullable', 'image', 'mimes:jpeg,jpg,png,gif,webp', 'max:8192'],
             'item_images' => ['nullable', 'array'],
             'item_images.*' => ['array'],
-            'item_images.*.*' => ['image', 'max:4096'],
+            'item_images.*.*' => ['mimes:jpeg,jpg,png,gif,webp', 'max:4096'],
         ]);
 
         $data = array_merge($request->all(), [