feat(recipe): validate heroImageUrl content type before persisting

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/test/java/com/recipeapp/recipe/RecipeServiceTest.java

@@ -571,6 +571,31 @@ class RecipeServiceTest {
                 .isInstanceOf(ResourceNotFoundException.class);
     }
 
+    @Test
+    void createRecipeWithDisallowedImageTypeShouldThrowValidationException() {
+        when(householdRepository.findById(HOUSEHOLD_ID)).thenReturn(Optional.of(testHousehold()));
+
+        var request = new RecipeCreateRequest(
+                "Test", null, null, "easy", "data:application/pdf;base64,abc",
+                List.of(), List.of(), List.of());
+
+        assertThatThrownBy(() -> recipeService.createRecipe(HOUSEHOLD_ID, request))
+                .isInstanceOf(com.recipeapp.common.ValidationException.class);
+    }
+
+    @Test
+    void createRecipeWithAllowedImageTypeShouldNotThrow() {
+        var household = testHousehold();
+        when(householdRepository.findById(HOUSEHOLD_ID)).thenReturn(Optional.of(household));
+        when(recipeRepository.save(any(Recipe.class))).thenAnswer(i -> i.getArgument(0));
+
+        var request = new RecipeCreateRequest(
+                "Test", null, null, "easy", "data:image/jpeg;base64,abc",
+                List.of(), List.of(), List.of());
+
+        assertThatNoException().isThrownBy(() -> recipeService.createRecipe(HOUSEHOLD_ID, request));
+    }
+
     @Test
     void listTagsShouldReturnEmptyList() {
         when(tagRepository.findByHouseholdId(HOUSEHOLD_ID)).thenReturn(List.of());