feat: Add Avatar Upload and Processing API

[Lanhubs]

closes #87

[3m1n3nc3]

Please add a comprehensive description for your PR

[Lanhubs]

Please add a comprehensive description for your PR

I implemented a complete avatar lifecycle for /api/v1/profile covering signed uploads, MIME/scan/processing validation, atomic finalization, replacement, and soft-deletion.
Key deliverables:

• Storage abstraction — StorageProvider interface with in-memory FakeStorageProvider (dev/test) and S3StorageProvider (production via @aws-sdk/s3-request-presigner); storage credentials are never returned.
• Image processing — ImageProcessor using sharp to strip metadata and generate webp (small/medium/original) and png (large) variants under folder layout avatars/{userId}/{uuid}/{variant}.
• Malware scanning — ClamAVScanner via clamdjs (real ClamAV daemon) with NoopScanner fallback for dev.
• Outbox-style processing — UploadIntent + UploadProcessingJob tables mirror the existing EmailDelivery queue pattern (5 attempts, exponential backoff, dead-letter).
• Lifecycle policy — Replacement atomically retires previous active asset; delete marks retired and schedules storage cleanup.
• Security — Cross-user finalize/delete returns 403; MIME spoofing rejected by sharp.metadata() + AV scan; invalid files never become active.
• OpenAPI — Full JSDoc on every endpoint and component schemas in src/docs/schemas.ts.
• Tests — 52 new tests covering storage, image processor, service, and controller (MIME spoofing, oversize, cross-user, idempotent retry, dead-letter, replace, delete).

[3m1n3nc3]

Please fix the conflicts