fix: add upload/delete file endpoints and wire avatar update through profile

- Add POST /upload and DELETE /assets/:id routes to backend (session auth via session_token cookie)
- Add avatar arg to updateProfile GraphQL mutation and resolver
- Fix frontend to pass avatarId correctly on save, preserve existing avatar when unchanged
- Ignore 404 on file delete (already gone is fine)
- Remove broken folder lookup (getFolders is a stub, backend has no folder concept)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/frontend/src/routes/me/+page.svelte

@@ -62,16 +62,20 @@
       isProfileError = false;
       profileError = "";
 
-      let avatarId = undefined;
+      let avatarId: string | null | undefined = undefined;
 
       if (!avatar?.id && data.authStatus.user!.avatar) {
+        // User removed their avatar
         await removeFile(data.authStatus.user!.avatar);
+        avatarId = null;
+      } else if (avatar?.id) {
+        // Keep existing avatar
+        avatarId = avatar.id;
       }
 
       if (avatar?.file) {
         const formData = new FormData();
-        formData.append("folder", data.folders.find((f) => f.name === "avatars")!.id);
-        formData.append("file", avatar.file!);
+        formData.append("file", avatar.file);
         const result = await uploadFile(formData);
         avatarId = result.id;
       }
@@ -82,7 +86,7 @@
         artist_name: artistName,
         description,
         tags,
-        avatar: avatarId,
+        avatar: avatarId ?? undefined,
       });
       toast.success($_("me.settings.toast_update"));
       invalidateAll();