Serve images as static files via /images/ route

[Copilot]

Images were served through an API handler (/api/image/<filename>) that added Python overhead on every request, used send_file with a manually-constructed path (path traversal risk), and required manual MIME type detection.

Changes

vest/app.py

• New /images/<path:filename> route replaces /api/image/ — delegates directly to send_from_directory(app.image_base_path, filename), which enforces directory confinement, handles MIME types automatically, and enables proper HTTP caching semantics
• Fixed path traversal in /api/keyframes/load — user-supplied filename was passed directly to os.path.join(cwd, filename); replaced with a glob-based lookup so the file path is never constructed from user input

vest/static/viewer.js

• Updated image URL template from `/api/image/${filename}` → `/images/${filename}`

tests/test_app.py (new)

• Tests for the /images/ route: no base path, successful serve, missing file, and path traversal rejection

DEVELOPMENT.md

• Updated route reference from GET /api/image/<filename> to GET /images/<filename>