feat: profile avatar upload + share_conv_keys rpc + favicon + smtp tweaks

supabase/migrations/20260419000003_profile_avatars.sql

@@ -0,0 +1,54 @@
+-- Profile-Avatar storage bucket.
+--
+-- Layout: <user_id>/<filename>.webp
+-- Public read so peers can see each other's avatar without auth roundtrip
+-- (avatars are non-sensitive). Write/update/delete restricted to the owning
+-- user via path prefix matching their auth.uid().
+
+insert into storage.buckets (id, name, public)
+values ('profile-avatars', 'profile-avatars', true)
+on conflict (id) do nothing;
+
+-- Read: anyone authenticated can view any avatar (public bucket also lets
+-- unauth fetch by URL but our RLS keeps the table-level policy explicit).
+drop policy if exists profile_avatars_select on storage.objects;
+create policy profile_avatars_select
+  on storage.objects
+  for select
+  to authenticated, anon
+  using (bucket_id = 'profile-avatars');
+
+-- Write only into your own folder (first path segment must equal auth.uid()).
+drop policy if exists profile_avatars_insert_own on storage.objects;
+create policy profile_avatars_insert_own
+  on storage.objects
+  for insert
+  to authenticated
+  with check (
+    bucket_id = 'profile-avatars'
+    and (storage.foldername(name))[1] = auth.uid()::text
+  );
+
+drop policy if exists profile_avatars_update_own on storage.objects;
+create policy profile_avatars_update_own
+  on storage.objects
+  for update
+  to authenticated
+  using (
+    bucket_id = 'profile-avatars'
+    and (storage.foldername(name))[1] = auth.uid()::text
+  )
+  with check (
+    bucket_id = 'profile-avatars'
+    and (storage.foldername(name))[1] = auth.uid()::text
+  );
+
+drop policy if exists profile_avatars_delete_own on storage.objects;
+create policy profile_avatars_delete_own
+  on storage.objects
+  for delete
+  to authenticated
+  using (
+    bucket_id = 'profile-avatars'
+    and (storage.foldername(name))[1] = auth.uid()::text
+  );