feat: implement stage 2 of Milkdown integration (secure upload & xss guard)

src/NexusReader.UI.Shared/Components/MarkdownEditor.razor

@@ -1,6 +1,7 @@
 @using Microsoft.JSInterop
 @implements IAsyncDisposable
 @inject IJSRuntime JS
+@inject HttpClient Http
 
 <div class="markdown-editor-container" style="height: @Height; width: @Width;">
     <div id="@EditorId" class="milkdown-editor-wrapper"></div>
@@ -73,6 +74,37 @@
         }
     }
 
+    [JSInvokable]
+    public async Task<string> UploadImageFromJs(string filename, string contentType, byte[] fileBytes)
+    {
+        try
+        {
+            using var content = new MultipartFormDataContent();
+            var fileContent = new ByteArrayContent(fileBytes);
+            fileContent.Headers.ContentType = new System.Net.Http.Headers.MediaTypeHeaderValue(contentType);
+            content.Add(fileContent, "file", filename);
+
+            var response = await Http.PostAsync("/api/media/upload", content);
+            if (response.IsSuccessStatusCode)
+            {
+                var result = await response.Content.ReadFromJsonAsync<NexusReader.Application.DTOs.Media.UploadResultDto>(
+                    NexusReader.Application.Common.AppJsonContext.Default.UploadResultDto);
+                return result?.Url ?? string.Empty;
+            }
+            else
+            {
+                var errorMsg = await response.Content.ReadAsStringAsync();
+                Console.WriteLine($"[MarkdownEditor] Image upload failed: {response.StatusCode} - {errorMsg}");
+                return string.Empty;
+            }
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"[MarkdownEditor] Exception during image upload: {ex.Message}");
+            return string.Empty;
+        }
+    }
+
     public async ValueTask DisposeAsync()
     {
         try