fix(security): apply image-security defaults on every creation path

Review follow-ups on the #1296 fix.

The defaults were resolved only in the admin POST / handler. POST
/api/v1/events builds its own insert and resolved just the devtools
setting, so an API-created gallery still fell back to the column
defaults — the same split that made #592 a separate bug from #317, about
to be repeated. Both paths now share resolveImageSecurityColumns().

An explicitly supplied value now wins over the global default. The
create routes never accepted these four fields at all, though PUT /:id
has validated them all along, so a client sending protection_level on
create had it silently dropped. The previous comment claimed the spread
ordering preserved a request value; there was no request value to
preserve, and a later spread would have overridden one anyway.

Settings validation no longer leans on parseInt, which rescues '72oops',
72.5 and [72] into valid-looking integers. The settings PUT stores
whatever JSON it is handed without validating values, so those really
can reach the resolver.

fragmentation_level is still stored and consumed by no renderer —
ProtectedImage hardcodes a 4-grid and secureImageService a 3x3. Noted in
the API docs rather than silently implied to work.

Refs #1296

backend/__tests__/integration/imageSecurityDefaults.test.js

@@ -23,10 +23,12 @@ describe('image-security creation defaults', () => {
   let db;
   let cleanup;
   let getImageSecurityDefaults;
+  let resolveImageSecurityColumns;
 
   beforeAll(async () => {
     ({ db, cleanup } = await bootCrmDb());
-    ({ getImageSecurityDefaults } = require('../../src/routes/adminEvents/helpers'));
+    ({ getImageSecurityDefaults, resolveImageSecurityColumns } =
+      require('../../src/routes/adminEvents/helpers'));
   }, 120000);
 
   afterAll(async () => {
@@ -82,6 +84,14 @@ describe('image-security creation defaults', () => {
     ['a non-numeric quality', 'default_image_quality', 'high'],
     ['fragmentation above the range', 'default_fragmentation_level', 99],
     ['a non-boolean canvas value', 'enable_canvas_rendering', 'yes'],
+    // parseInt would have rescued each of these into a valid-looking
+    // integer. The settings PUT stores values without validating them, so
+    // they can genuinely be in the table.
+    ['a numeric prefix with trailing junk', 'default_image_quality', '72oops'],
+    ['a fractional quality', 'default_image_quality', 72.5],
+    ['a single-element array', 'default_image_quality', [72]],
+    ['a fractional fragmentation level', 'default_fragmentation_level', 3.7],
+    ['a fragmentation level with trailing junk', 'default_fragmentation_level', '3x'],
   ])('ignores %s and falls through to the column default', async (_label, key, value) => {
     await setSetting(key, value);
     expect(await getImageSecurityDefaults()).toEqual({});
@@ -96,4 +106,53 @@ describe('image-security creation defaults', () => {
     await setSetting('default_image_quality', { nonsense: true });
     await expect(getImageSecurityDefaults()).resolves.toEqual({});
   });
+
+  describe('resolveImageSecurityColumns', () => {
+    it('omits every column when neither the request nor the settings supply one', () => {
+      expect(resolveImageSecurityColumns({}, {})).toEqual({});
+    });
+
+    it('uses the global default when the request says nothing', () => {
+      expect(resolveImageSecurityColumns({}, { protection_level: 'maximum' }))
+        .toEqual({ protection_level: 'maximum' });
+    });
+
+    it('lets an explicit request value win over the global default', () => {
+      expect(resolveImageSecurityColumns(
+        { protection_level: 'basic' },
+        { protection_level: 'maximum' },
+      )).toEqual({ protection_level: 'basic' });
+    });
+
+    it('keeps an explicit false canvas value instead of reading it as absent', () => {
+      const columns = resolveImageSecurityColumns(
+        { use_canvas_rendering: false },
+        { use_canvas_rendering: true },
+      );
+      expect(columns.use_canvas_rendering).toBeFalsy();
+    });
+
+    it('keeps a zero-ish explicit value rather than falling through', () => {
+      // 0 is out of range for the column, but the guard is `!== undefined`,
+      // not truthiness — the validator is what rejects out-of-range input.
+      expect(resolveImageSecurityColumns({ image_quality: 0 }, { image_quality: 85 }))
+        .toEqual({ image_quality: 0 });
+    });
+
+    it('resolves each column independently', () => {
+      expect(resolveImageSecurityColumns(
+        { image_quality: 60 },
+        { protection_level: 'enhanced', fragmentation_level: 4 },
+      )).toEqual({
+        protection_level: 'enhanced',
+        image_quality: 60,
+        fragmentation_level: 4,
+      });
+    });
+
+    it('tolerates a missing body, which is what an empty API request looks like', () => {
+      expect(resolveImageSecurityColumns(undefined, { image_quality: 90 }))
+        .toEqual({ image_quality: 90 });
+    });
+  });
 });