API controller for image upload