Create a Robust File Upload Handler with Validation and Cloud Storage Integration

Build a complete file upload handler for a [FRAMEWORK] application in [PROGRAMMING_LANGUAGE] that supports single and multiple file uploads with comprehensive validation and cloud storage integration. The handler should meet these requirements: 1. **Upload Endpoint(s)**: - Create a [HTTP_METHOD] endpoint at `/api/[RESOURCE]/upload` that accepts multipart/form-data. - Support both single file uploads and batch uploads of up to [MAX_FILES] files per request. - Accept an optional [METADATA_FIELDS] (e.g., description, category, tags) alongside the file(s). 2. **File Validation**: - Restrict allowed MIME types to [ALLOWED_TYPES] (e.g., image/jpeg, image/png, application/pdf). - Enforce a maximum file size of [MAX_FILE_SIZE] per file. - Validate the file's magic bytes (not just the extension) to prevent disguised malicious files. - Sanitize file names to remove special characters, path traversals, and Unicode tricks. - Scan for or flag potential security risks (e.g., executable content in images, embedded scripts in PDFs). 3. **Processing Pipeline**: - For image uploads: generate a thumbnail ([THUMBNAIL_SIZE] pixels) and optimize/compress the original. - Generate a unique file name using UUID or content hash to prevent collisions. - Extract and store file metadata (size, dimensions for images, MIME type, upload timestamp). 4. **Storage Integration**: - Upload processed files to [STORAGE_PROVIDER] (e.g., AWS S3, Google Cloud Storage, Azure Blob, local disk). - Organize files into structured paths: `[BUCKET_NAME]/[RESOURCE]/{year}/{month}/{uuid}.{ext}`. - Generate and return a signed URL (with [URL_EXPIRY] expiration) or public URL based on a visibility parameter. 5. **Database Record**: Save a file record to the database with fields: id, original_name, stored_path, mime_type, size_bytes, uploaded_by, thumbnail_path, created_at. Provide the schema/model definition. 6. **Error Handling & Progress**: Return clear validation error messages for rejected files. Include guidance on how to implement upload progress tracking on the client side. Provide complete working code including the route, controller/handler, validation logic, storage utility, and database model. List all required dependencies and environment variables.