- Add POST /upload and DELETE /assets/:id routes to backend (session auth via session_token cookie) - Add avatar arg to updateProfile GraphQL mutation and resolver - Fix frontend to pass avatarId correctly on save, preserve existing avatar when unchanged - Ignore 404 on file delete (already gone is fine) - Remove broken folder lookup (getFolders is a stub, backend has no folder concept) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>