Validating image uploads with magic bytes in SvelteKit file.type and the filename are claims from the browser. Read the first bytes of the upload in SvelteKit and keep only JPEG, PNG, or WebP.