feat(avatars): image upload for users and bots

[haowei2000]

What

Full avatar image upload for users and bots (optimization #1). Users set their own avatar; a bot's is owner/admin-only. Images are stored in object storage and served over a public URL.

Backend

• POST /api/v1/users/me/avatar (self) and POST /api/v1/bots/:bot_id/avatar (owner/admin) — body is raw image bytes. Stores to avatars/{kind}/{id}/{uuid}.{ext} and writes the serving URL into the existing avatar_url column.
• Public GET /api/v1/{users,bots}/:id/avatar/:file — serves the bytes inline with a 1-day cache. Public because an <img src> can't attach a Bearer token and an avatar isn't sensitive; the path is validated (owner = uuid, file = {hex-uuid}.{known-ext}) so a crafted key can't escape the avatars/ prefix.
• Accepts raster only (png/jpeg/webp/gif), ≤ 5 MiB. SVG is rejected (file_response forces SVG to download, so it'd never render).

Frontend

• New AvatarUpload component: hover camera overlay → file picker → optimistic object-URL preview while the upload runs, then persists.
• Wired into the profile editor (Settings) and the bot status editor.

Verification

Tested end-to-end against the local kind stack:

Case	Result
User upload	200, byte-perfect round-trip (198 → 198)
Public serve	200 image/png, content-disposition: inline, cache-control: max-age=86400
Persisted	GET /users/me returns the new avatar_url
Bot upload (owner/admin)	200
Non-image content-type	400
Empty body	400
No auth	401
UI (Settings)	camera-hover affordance renders; picked image uploads and, after a fresh reload, renders from the persisted server URL

🤖 Generated with Claude Code