Owner-only avatar upload, read and deletion use a private filesystem volume with PostgreSQL references. Uploads are signature-checked and re-encoded into a 512px WebP without original metadata, with byte/pixel/time/concurrency limits and persistent account quotas. Commit-safe replacement and orphan cleanup preserve existing photos on database failure.

Companion mobile PR: snag-tcg/poc-tcg-collector#660. Deployment requires migration 0040, a backed-up database and the private volume. Existing Sharp/Busboy security advisories were discovered during validation. Kael approved targeted updates: Sharp 0.35.5 in API/ingest and Busboy 3.2.3. The API audit then reported no high or critical findings; one moderate ip-address advisory remains out of scope. Deployment is authorized after validated PRs, not a complete security certification.

PR #472 was merged into staging on 2026-10-13 after all six CI gates passed. The VPS rollout verified a full PostgreSQL backup, applied only migration 0040 and recreated only the API. Live synthetic-account checks passed for Linux decoding, metadata stripping, owner-only reads, spoof rejection, replacement and deletion; test accounts and files were removed afterwards. The public readiness endpoint returned 200. Private file volume permissions are 0700; backup 0600. The release override retains existing API configuration and provides a previous image rollback without reversing the additive migration.