Add server-side content filtering to block spam

- Require message to have at least 3 words — catches single-token
  random strings like 'EhdRpaTrHsSahuiuz'
- Require message to be at least 10 characters
- Validate email format server-side (was client-side only)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

main-site/server.js

@@ -164,6 +164,14 @@ apiRouter.post('/contact', upload.array('photos', 3), async (req, res) => {
         return res.status(400).json({ success: false, message: 'Please fill in all required fields.' });
     }
 
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim())) {
+        return res.status(400).json({ success: false, message: 'Please enter a valid email address.' });
+    }
+
+    if (message.trim().length < 10 || message.trim().split(/\s+/).length < 3) {
+        return res.status(400).json({ success: false, message: 'Please enter a more detailed message.' });
+    }
+
     const attachments = [];
     for (const file of (req.files || [])) {
         const webpBuffer = await sharp(file.buffer).webp({ quality: 85 }).toBuffer();