[Eoic]

Profile photo selection previously had no persistent server upload path. Add owner-authenticated upload/download endpoints and save the display name and photo reference together.

• Bound JPEG/PNG uploads to 5 MiB and check their signatures.
• Serialize profile writes on the owner row, retain the old photo on failed commits, and remove replaced files only after commit.
• Serve only the current owner's photo with private/no-store and nosniff headers. Existing permanent account cleanup removes stored photos.
• Reuse avatar_url and owner media directories. No migration, new dependency, version bump, or PowerSync change.

Validation

33 PostgreSQL-backed tests passed across avatar, user, and account deletion routes/services. Ruff lint/formatting, strict Mypy, and OpenAPI export consistency passed.

Delivery

Deploy this server change before the companion client that offers photo uploads. Live production/provider acceptance was not run.

Companion client: PapyrusReader/client#83.
Contract documentation: PapyrusReader/docs#88.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T01:51:37.151196Z	235fd05	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.