Uses src as the unique key: if the incident already contains an image with the same src, its href / alt are updated in place; otherwise a new entry is appended.Constraints:
Each incident may hold at most 5 images; exceeding this limit returns 400.
src must start with img_ or http, with a trimmed length not exceeding 512 characters.
alt is capped at 128 characters and href at 512 characters (any excess is silently truncated).
When the incident is in the closed state, the data is still written but no card refresh is triggered.