Add an image button to the comment toolbar backed by a new upload route (images only, 5 MB, stored under comments/<userId>/), inserted as Markdown. Only images served from our own storage are rendered: a third-party src would be fetched by every reader of the lesson, exposing their address. Such links are shown as plain links instead — this also defuses the external images a few existing comments already carry.