fix: add upload/delete file endpoints and wire avatar update through profile

- Add POST /upload and DELETE /assets/:id routes to backend (session auth via session_token cookie)
- Add avatar arg to updateProfile GraphQL mutation and resolver
- Fix frontend to pass avatarId correctly on save, preserve existing avatar when unchanged
- Ignore 404 on file delete (already gone is fine)
- Remove broken folder lookup (getFolders is a stub, backend has no folder concept)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/frontend/src/lib/services.ts

@@ -573,6 +573,7 @@ const UPDATE_PROFILE_MUTATION = gql`
     $artistName: String
     $description: String
     $tags: [String!]
+    $avatar: String
   ) {
     updateProfile(
       firstName: $firstName
@@ -580,6 +581,7 @@ const UPDATE_PROFILE_MUTATION = gql`
       artistName: $artistName
       description: $description
       tags: $tags
+      avatar: $avatar
     ) {
       id
       email
@@ -609,6 +611,7 @@ export async function updateProfile(user: Partial<User> & { password?: string })
           artistName: user.artist_name,
           description: user.description,
           tags: user.tags,
+          avatar: user.avatar,
         },
       );
       return data.updateProfile;
@@ -652,7 +655,8 @@ export async function removeFile(id: string) {
         method: "DELETE",
         credentials: "include",
       });
-      if (!response.ok) throw new Error(`Failed to delete file: ${response.statusText}`);
+      if (!response.ok && response.status !== 404)
+        throw new Error(`Failed to delete file: ${response.statusText}`);
     },
     { fileId: id },
   );

packages/frontend/src/routes/me/+page.svelte

@@ -62,16 +62,20 @@
       isProfileError = false;
       profileError = "";
 
-      let avatarId = undefined;
+      let avatarId: string | null | undefined = undefined;
 
       if (!avatar?.id && data.authStatus.user!.avatar) {
+        // User removed their avatar
         await removeFile(data.authStatus.user!.avatar);
+        avatarId = null;
+      } else if (avatar?.id) {
+        // Keep existing avatar
+        avatarId = avatar.id;
       }
 
       if (avatar?.file) {
         const formData = new FormData();
-        formData.append("folder", data.folders.find((f) => f.name === "avatars")!.id);
-        formData.append("file", avatar.file!);
+        formData.append("file", avatar.file);
         const result = await uploadFile(formData);
         avatarId = result.id;
       }
@@ -82,7 +86,7 @@
         artist_name: artistName,
         description,
         tags,
-        avatar: avatarId,
+        avatar: avatarId ?? undefined,
       });
       toast.success($_("me.settings.toast_update"));
       invalidateAll();