Secure profile photo uploads and trust configured production origin

supabase/migrations/20261015085948_avatar_upload_hardening.sql

@@ -0,0 +1,13 @@
+-- The application server is the only writer for public profile avatars. It
+-- validates and re-encodes uploads, applies an account rate limit, and removes
+-- replaced files. Client-side Storage uploads could bypass those controls.
+drop policy if exists "MineGeo users upload their own avatars"
+  on storage.objects;
+drop policy if exists "MineGeo users delete their own avatars"
+  on storage.objects;
+
+update storage.buckets
+set public = true,
+    file_size_limit = 5242880,
+    allowed_mime_types = array['image/webp']
+where id = 'minegeo-avatars';