Add profile photo uploads and custom difficulty support

docs/multiplayer.md

@@ -15,6 +15,12 @@ score zero. The owner can advance from the round standings, or the next round
 starts automatically after 20 seconds. The final table ranks total points;
 equal totals share a place.
 
+Choose one of the built-in difficulties or create a named custom difficulty
+with its own round time and zoom setting. Custom difficulties are saved in the
+shared MineGeo catalog and can be reused on any map. Multiplayer rooms snapshot
+the selected settings when created, so every invited player follows the same
+rules.
+
 Players join without an account. A separate HttpOnly cookie identifies each
 browser, and the room link acts as the invitation. Only the server can access
 the room tables and functions. Clients receive the current round's signed
@@ -43,6 +49,9 @@ Apply `supabase/migrations/20261007071259_multiplayer_rooms.sql` to a new databa
 before deploying the web update. It has already been applied to MineGeo's
 configured Supabase project. Deployments continue through `npm run deploy`
 without a Git-provider connection.
+Custom difficulty presets also require
+`supabase/migrations/20261013095201_custom_difficulty_presets.sql` before the
+web update. No additional environment variables are needed.
 Chat additionally requires `supabase/migrations/20261007155622_multiplayer_chat.sql`.
 
 - `npm test`: validation and existing regression checks.

docs/vercel-deployment.md

@@ -114,3 +114,13 @@ permissions. Closed reports move to Done and are deleted from MineGeo and Linear
 after three days through a durable workflow; no cron job is required.
 Glow colors and user prefixes also require `20261008075322_profile_identity.sql`
 before deploying the updated account, catalog, and multiplayer pages.
+
+Custom difficulty presets for solo and multiplayer games require
+`20261013095201_custom_difficulty_presets.sql` before deploying. The migration
+stores the shared presets and snapshots their settings in each game and room.
+No additional Vercel environment variables are needed.
+
+Account photo uploads require `20261013123545_profile_avatars.sql` before
+deploying. The migration creates the public avatar bucket with a 5 MiB file
+limit and owner-scoped upload/delete policies. Existing public Supabase
+environment variables are sufficient; no additional secrets are needed.