Unknown /upload/image type returns 500 instead of a client error

## Expected Behavior

`POST /upload/image` and `POST /upload/mask` should return a handled client
error when the multipart `type` value is not one of `input`, `temp`, or
`output`. Recognized values should continue returning their normal successful
response.

## Actual Behavior

`get_dir_by_type()` binds `type_dir` only inside the recognized-value branches.
An unknown value reaches `return type_dir, dir_type` with `type_dir` unbound,
so `UnboundLocalError` escapes the request handler and aiohttp returns HTTP
500.

## Steps to Reproduce

1. Start current ComfyUI without custom nodes.
2. Create any small valid PNG named `x.png`.
3. Send:

```console
curl -i -F "image=@x.png" -F "type=foo" http://127.0.0.1:8188/api/upload/image
```

4. Observe HTTP 500.
5. As a control, repeat with `type=input`; it returns HTTP 200 with the usual
upload JSON.

The same behavior is reachable through `/upload/mask`, which shares the helper.

## Debug Logs

```text
UnboundLocalError: cannot access local variable 'type_dir' where it is not associated with a value
```

Reproduced against `master` at
`f966a2b38c21702c906ab4103261641c322e0a2d`. A loopback regression harness
confirmed that `input`, `temp`, and `output` return HTTP 200 while unknown or
empty values currently produce HTTP 500.

## Other

This is a core server behavior and does not involve custom nodes. Returning a
400 for an unrecognized type matches the existing client-error responses in
the same upload handler.

Locate get_dir_by_type() and the shared handlers for POST /upload/image and /upload/mask. Reproduce the issue with the provided curl command, then verify that unknown or empty type values return a handled 400 client error while input, temp, and output continue returning their normal successful responses.

Written by the indexing model from the issue text.