The profile screen used to ask users to paste a public image URL into an "Avatar URL" field — fine for tech-savvy folks, awkward for everyone else.

Now the avatar field is a proper upload control:

• Click, drag-and-drop, or paste-from-clipboard a PNG / JPG / WebP / AVIF / GIF / SVG (≤ 10 MB)
• Files go through /api/uploads with kind=avatar, which authenticates, validates MIME + size, and stores under avatar/<user_id>/<uuid>.ext in the public Supabase Storage bucket (S3-compatible)
• Each user's avatars are namespaced to their own user-id folder, with the storage path derived server-side from auth.uid() so it's unforgeable
• "Replace" + "Remove" actions inline; persists immediately on upload so the sidebar widget refreshes via router.refresh() without forcing the user to click Save

The DB column is unchanged — profiles.avatar_url still holds the public URL, just now pointing at a Hollahoop-owned storage object instead of an arbitrary external URL.