Frontend "Remove avatar" needs a way to clear the current user's picture
without uploading a placeholder. Adds the missing route.
- S3Storage::delete wraps aws_sdk_s3 DeleteObject. MinIO's delete is
idempotent for missing keys, so a stray miss is silent.
- repo::clear_avatar returns true when a row existed so the handler can decide
whether to also try the S3 delete (skip for users without an avatar).
- handlers::delete is authenticated (GatewayIdentity) and always returns 204,
matching how the frontend button should behave after a repeat click.
S3 delete is best-effort: if MinIO is unreachable we already committed the
DB row removal and log a warn — the object becomes orphaned but is not
served, because serve() looks up keys via the DB, not by URL.
- Route registered on the existing avatar_routes Router.
- 3 tests: happy path (post-then-delete → count==0), idempotent no-op,
401 without identity.
loki5512344
a597425e45
