feat: add project and associations image management - #39

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/routers/web/associations.ts`:
- Around line 88-89: The blob upload mutations currently run through
publicProcedure and can call uploadBlob without auth, so switch these handlers
to an authenticated/admin-only procedure before any upload logic. Update the
relevant association mutation(s) in associations.ts that build uploadedLogo and
the other uploadBlob call so only authorized callers can reach Buffer.from(...),
getImageExtension(...), and uploadBlob.
- Around line 120-129: The edit flow in associations.ts currently clears the
existing logo when no new file is uploaded. Update the update path around the
uploadBlob handling and DB.update(ASSOCIATIONS).set(...) so logo is only changed
when a new file is provided, and otherwise left untouched; if intentional
removal is needed, add an explicit remove flag in the same update logic.
- Around line 29-34: The associationFormSchema currently allows empty strings
for name, descriptionIt, and descriptionEn because it uses z.string() directly.
Update associationFormSchema in associations.ts to trim these fields and enforce
non-empty content (for example by using nonempty/min length after trimming) so
blank association text cannot be submitted, while leaving logo optional as-is.

In `@src/routers/web/projects.ts`:
- Around line 55-56: The project mutation(s) in projects.ts are uploading blobs
from publicProcedure, so unauthenticated callers can reach uploadBlob and write
to Azure Blob storage. Move these upload paths behind an
authenticated/admin-only procedure before the uploadBlob call, and keep the
existing logo/image validation intact while ensuring only authorized users can
trigger the mutation.
- Around line 88-97: The edit flow in the project update logic is overwriting an
existing logo with null when no new file is uploaded. Update the PROJECTS update
path in the project router so the logo field is only changed when a new upload
is present, or add a dedicated removal flag to explicitly clear it; keep the
current logo unchanged for text-only edits. Use the existing uploadBlob handling
and the DB.update(PROJECTS) call as the place to gate the logo assignment.
- Around line 17-24: Project form validation still allows empty required text
fields and whitespace-only links; update projectFormSchema to trim title,
descriptionIt, and descriptionEn before validation so empty values are rejected,
and normalize link by trimming whitespace before converting an empty result to
null. Keep the change localized to the projectFormSchema in projects.ts and
preserve the existing logo and category handling.