Import march-2020-03-10 from private repo (scrubbed 2026-05-27)

Targets Rec Room 2020.03.10 client (also serves 2020.03.06).

Re-import after adding:
- DorkNet.ClientMod/dorknet-clientmod.json.template — config schema
  the launcher's manifest-driven patcher renders into UserData/.
- tools/build-patcher-zip.ps1 — produces dorknet-clientpatch-{key}.zip
  for v1-march-* Release uploads.
- .github/workflows/release.yml — on tag push publishes both
  dorknet-server-march_2020_03_10-win-x64.zip and
  dorknet-clientpatch-march_2020_03_10.zip as Release assets.

Same scrub rules as december; tools/build-patcher-zip.ps1 added to
the maintainer-side allow-list so it survives.

DorkNet.Server/Controllers/API/Images/V2/ImagesController.cs

@@ -0,0 +1,39 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using System.Security.Claims;
+
+namespace DorkNet.Server.Controllers.API.Images.V2;
+
+[ApiController]
+[Route("api/[controller]/v2")]
+[Authorize]
+public class ImagesController : ControllerBase
+{
+    private static readonly string ImageDir =
+        Path.Combine(AppContext.BaseDirectory, "data", "images");
+
+    [HttpPost("upload")]
+    public async Task<ActionResult<UploadImageResponse>> Upload(IFormFile file)
+    {
+        Directory.CreateDirectory(ImageDir);
+
+        var ext = Path.GetExtension(file.FileName).ToLowerInvariant();
+        if (ext is not (".png" or ".jpg" or ".jpeg"))
+            return BadRequest("Only PNG/JPG accepted");
+
+        var name = $"{Guid.NewGuid():N}{ext}";
+        var path = Path.Combine(ImageDir, name);
+
+        await using var stream = System.IO.File.Create(path);
+        await file.CopyToAsync(stream);
+
+        var baseUrl = $"{Request.Scheme}://{Request.Host}";
+        return Ok(new UploadImageResponse { ImageName = name, Url = $"{baseUrl}/img/{name}" });
+    }
+}
+
+public class UploadImageResponse
+{
+    public string ImageName { get; set; } = string.Empty;
+    public string Url { get; set; } = string.Empty;
+}