🛡️ Sentinel: Fix Stored XSS via Content-Type spoofing in asset proxies (#237)

Sanitized the Content-Type header on image and video proxy routes (`/api/image/*`, `/api/video/*`). The content type is forced to lowercase, validated against a safe prefix (`image/`, `video/`, `audio/`), and restricted to block `svg` and `xml`. Any invalid type falls back to `application/octet-stream`. This prevents an attacker from uploading an SVG file containing a malicious script and triggering a Stored XSS attack via these proxy endpoints, which are excluded from the global CSP.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

lib/__tests__/immich.test.ts

@@ -14,6 +14,7 @@ vi.mock('../config', async () => {
       standaloneAlbums: ['album-1'],
       subpages: [],
       albumOverrides: { 'album-1': 'Override Name' },
+      albumDescriptions: {},
       cacheTtl: 0,
     }),
   };