Bound uploadImage/deleteImage timeout (data-driven, not guessed)

uploadImage and deleteImage still have no timeout (fetchImage now bounded at 20s, ebf52b0). Deliberately deferred by coder-mars-cc from MARS-343 -- an upload bound needs a different number than a serve (10MB over a student phone connection) and picking one without data would be guessing. Gather real upload duration data first, then set a bound.