feat(profile): add uploadable avatars with local/S3 storage

Users can upload and remove profile pictures on the profile page.
Admins choose local or instance S3 storage in advanced settings.
Avatars are compressed to JPEG and served via a private cached route.

app/Models/InstanceSettings.php

@@ -49,6 +49,8 @@ class InstanceSettings extends Model
         'is_mcp_server_enabled',
         'webhook_allowed_internal_hosts',
         'webhook_allow_localhost',
+        'avatar_storage_type',
+        'avatar_s3_storage_id',
     ];
 
     protected $hidden = [

app/Models/S3Storage.php

@@ -7,6 +7,7 @@ use App\Rules\ValidS3BucketName;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Filesystem\FilesystemAdapter;
 use Illuminate\Notifications\Messages\MailMessage;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Facades\Validator;
@@ -184,19 +185,7 @@ class S3Storage extends BaseModel
                 throw new \RuntimeException('S3 bucket name is not allowed: '.$validator->errors()->first('bucket'));
             }
 
-            $disk = Storage::build([
-                'driver' => 's3',
-                'region' => $this['region'],
-                'key' => $this['key'],
-                'secret' => $this['secret'],
-                'bucket' => $this['bucket'],
-                'endpoint' => $this['endpoint'],
-                'use_path_style_endpoint' => true,
-                'http' => array_merge(SafeWebhookUrl::httpClientOptions($this['endpoint'], $this->trustedInternalHosts()), [
-                    'connect_timeout' => self::CONNECTION_TIMEOUT_SECONDS,
-                    'timeout' => self::REQUEST_TIMEOUT_SECONDS,
-                ]),
-            ]);
+            $disk = $this->filesystem();
             // Test the connection by listing files with ListObjectsV2 (S3)
             $disk->files();
 
@@ -235,6 +224,23 @@ class S3Storage extends BaseModel
         }
     }
 
+    public function filesystem(): FilesystemAdapter
+    {
+        return Storage::build([
+            'driver' => 's3',
+            'region' => $this['region'],
+            'key' => $this['key'],
+            'secret' => $this['secret'],
+            'bucket' => $this['bucket'],
+            'endpoint' => $this['endpoint'],
+            'use_path_style_endpoint' => true,
+            'http' => array_merge(SafeWebhookUrl::httpClientOptions($this['endpoint'], $this->trustedInternalHosts()), [
+                'connect_timeout' => self::CONNECTION_TIMEOUT_SECONDS,
+                'timeout' => self::REQUEST_TIMEOUT_SECONDS,
+            ]),
+        ]);
+    }
+
     /**
      * The bundled MinIO container is a trusted internal S3 target, not a user-supplied webhook destination.
      *

app/Models/User.php

@@ -53,6 +53,9 @@ class User extends Authenticatable implements SendsEmail
         'pending_email',
         'email_change_code',
         'email_change_code_expires_at',
+        'avatar_path',
+        'avatar_storage_type',
+        'avatar_s3_storage_id',
     ];
 
     protected $hidden = [