Images binding: metadata filtering, signedUrl, and createDirectUpload

[Monark-Arkmon]

Three additions to the Images binding, bringing env.IMAGES.hosted up to parity with capabilities that already exist via the REST API / manual workflows:

Metadata filtering on list()

env.IMAGES.hosted.list({
  filter: { metadata: { status: "active", priority: { gte: 2, lte: 8 } } },
});

Adds filter.metadata to ImageListOptions, matching the /v2/images metadata filtering already supported by images-core. Vectorize-style shape: bare operators (eq/in/gt/gte/lt/lte), a bare value is implicit eq. Nested under filter.metadata (not top-level) to leave room for filter.creator later without breaking this shape.

signedUrl() on ImageHandle

const url = await env.IMAGES.hosted
  .image("my-image-id")
  .signedUrl({ variant: "private", expiresIn: 86_400 });

Lets a Worker get a signed imagedelivery.net URL for a private image without handling the account signing key or HMAC logic itself. Signing happens server-side in images-edge-api; hosted.image(id) already returns an RPC stub, so this method forwards automatically, no logic change needed in workerd beyond the type.

createDirectUpload() on HostedImagesBinding

const { id, uploadURL } = await env.IMAGES.hosted.createDirectUpload({
  metadata: { userId: "abc123" },
  requireSignedURLs: true,
  expiresIn: 600,
});

Lets a Worker create a Direct Creator Upload link natively, instead of hand-rolling a fetch() to /images/v2/direct_upload with an API token as a secret. Lands directly on HostedImagesBinding (not per-image), so it needs an explicit forwarding method on HostedImagesBindingImpl, matching how upload()/list() already forward to the RPC stub.