Verify avatar auth tokens

[phucnguyen1707]

Summary

• replace manual avatar JWT payload decoding with Supabase auth token verification
• keep service-role storage/database work behind a verified user id
• add regression coverage for forged bearer tokens on upload and delete

Fixes #90

Verification

• pnpm vitest run --config /tmp/vitest-qryptchat-api.config.js src/app/api/auth/upload-avatar/route.test.js
• pnpm exec oxlint src/app/api/auth/upload-avatar/route.js src/app/api/auth/upload-avatar/route.test.js