feat: avatar upload to S3, proxied through the backend (#733) (#872)

- POST /api/users/profile/avatar: authenticated multipart upload
- Accepts field name 'file' or 'avatar'
- Decodes image, resizes to 256x256, re-encodes as JPEG (quality 85)
- Uploads to S3 via aws-sdk-s3 (credentials from standard AWS chain)
- Saves public URL to users.avatar_url, invalidates Redis cache
- Config: AWS_S3_BUCKET, AWS_S3_REGION, AWS_S3_PUBLIC_URL_BASE env vars

Author: benedictworks-home