Adds POST/DELETE /userimage (authenticated-only), enforcing the
self-or-admin write rule and the EnableUserAvatarUpload flag. Also
strengthens the anonymous-401 GET /userimage test to seed the private
user with a real avatar file, so it fails for the right reason if the
isPublicUser gate is ever removed.