fix(security): Unauthenticated shell command injection in todo image processing

[sozercan]

Security remediation for finding fnd_be61bc01aedd.

Summary:
POST /create accepts attacker-controlled markdown image content, extracts a URL with a broad regex, and concatenates it into child_process.exec('identify ' + url). Because the command is executed through the shell with no quoting or argument separation, shell metacharacters in the captured URL can trigger arbitrary command execution on the app host.

Root cause:
Untrusted request data is interpolated into a shell command string and executed via exec().

Remediation guidance:
Avoid the shell entirely: parse and validate the URL, then use execFile/spawn with a fixed argument vector or remove the external command dependency.