Local file write via unrestricted output path

Path traversal in image-gen-mcp 0.1.0 allows local users to write generated image data outside the configured output directory. The upscale_images handler normalizes caller-controlled output_path, recursively creates that directory, and writes upscaled image files without checking that the resolved path remains under SD_OUTPUT_DIR. An attacker must be able to invoke the local MCP tool and can create directories or predictably overwrite files writable by the server process, although file contents remain constrained to generated image data.