Phase 3: Foto-Upload + Mindeststrecken-Warnung

- APIClient.uploadFile: multipart POST mit Bearer-Token, generischer
  field/filename/mime
- ImageResize: längste Kante max 2048px, JPEG q=0.8 — iPhone-Fotos sonst
  5-10MB pro Stück
- FinishWalkSheet:
  - PhotosPicker (iOS 16+, kein NSPhotoLibraryUsageDescription nötig)
  - Thumbnail-Strip der gewählten Fotos
  - Sequentieller Upload nach POST /api/routes, Toolbar zeigt "N/M"
  - Bei < 50m: orangene Warnung "Sehr kurze Tour — du kannst trotzdem speichern"
  - Save-Button blockt korrekt während Upload, Verwerfen auch

BanYaroGo/API/APIClient.swift

@@ -31,6 +31,43 @@ final class APIClient {
         try await perform(method: "POST", path: path, body: nil)
     }
 
+    /// Multipart-File-Upload. Server-Endpunkte wie POST /api/routes/{id}/photo
+    /// erwarten Feld `file` mit JPEG-Bytes.
+    @discardableResult
+    func uploadFile(
+        _ path: String,
+        fieldName: String = "file",
+        filename: String,
+        data: Data,
+        mimeType: String = "image/jpeg"
+    ) async throws -> Data {
+        let boundary = "Boundary-\(UUID().uuidString)"
+        let url = baseURL.appending(path: path)
+        var req = URLRequest(url: url)
+        req.httpMethod = "POST"
+        req.setValue("application/json", forHTTPHeaderField: "Accept")
+        if let token {
+            req.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+        }
+        req.setValue("multipart/form-data; boundary=\(boundary)", forHTTPHeaderField: "Content-Type")
+
+        var body = Data()
+        body.append("--\(boundary)\r\n".data(using: .utf8)!)
+        body.append("Content-Disposition: form-data; name=\"\(fieldName)\"; filename=\"\(filename)\"\r\n".data(using: .utf8)!)
+        body.append("Content-Type: \(mimeType)\r\n\r\n".data(using: .utf8)!)
+        body.append(data)
+        body.append("\r\n--\(boundary)--\r\n".data(using: .utf8)!)
+
+        let (responseData, response) = try await session.upload(for: req, from: body)
+        guard let http = response as? HTTPURLResponse else {
+            throw APIError.invalidResponse
+        }
+        guard (200..<300).contains(http.statusCode) else {
+            throw APIError.server(status: http.statusCode, message: Self.parseErrorDetail(from: responseData))
+        }
+        return responseData
+    }
+
     private func perform<T: Decodable>(method: String, path: String, body: Data?) async throws -> T {
         let url = baseURL.appending(path: path)
         var req = URLRequest(url: url)