chore: relocate backend into apps/api ahead of monorepo merge

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/middleware/badge_upload.middleware.js

@@ -0,0 +1,32 @@
+'use strict';
+
+const multer = require('multer');
+
+const ALLOWED_MIME = new Set([
+  'image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/svg+xml',
+]);
+
+const upload = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: 5 * 1024 * 1024 }, // 5 MB
+  fileFilter(req, file, cb) {
+    if (ALLOWED_MIME.has(file.mimetype)) return cb(null, true);
+    cb(Object.assign(new Error('Only JPEG, PNG, WebP, GIF, or SVG images are allowed.'), { code: 'INVALID_TYPE' }));
+  },
+});
+
+const badgeSingle = upload.single('badge');
+
+const handleBadgeUpload = (req, res, next) => {
+  badgeSingle(req, res, (err) => {
+    if (!err) return next();
+    if (err.code === 'LIMIT_FILE_SIZE')
+      return res.status(400).json({ status: 'error', message: 'Badge image must be under 5 MB.' });
+    if (err.code === 'INVALID_TYPE')
+      return res.status(400).json({ status: 'error', message: err.message });
+    console.error('[MULTER BADGE]', err);
+    return res.status(400).json({ status: 'error', message: err.message ?? 'Upload failed.' });
+  });
+};
+
+module.exports = { handleBadgeUpload };