* HH-438: close upload and remote URL attack surfaces
* HH-438: use valid PNG in direct upload test
* HH-438: align PostgreSQL upload staging schema
* HH-438: run upload migrations before PostgreSQL E2E
---------
Co-authored-by: Rogee <rogee@ipao.vip>