feat: add signed bind-backed user icon uploads

compose.yaml

@@ -4,7 +4,7 @@ services:
   image-hook:
     build:
       context: ./node-hook
-    image: sam-image-hook:1.1.0
+    image: sam-image-hook:1.2.0
     restart: unless-stopped
     user: "${IMAGE_UID:-1000}:${IMAGE_GID:-1000}"
     read_only: true
@@ -18,9 +18,13 @@ services:
       IMAGE_ALLOWED_BRANCHES: ${IMAGE_ALLOWED_BRANCHES:-master}
       IMAGE_PUBLIC_BASES: ${IMAGE_PUBLIC_BASES:-https://sam.hided.net/image,https://sam-image.hided.net}
       IMAGE_STATE_PATH: /var/lib/image-hook/state.json
+      IMAGE_UPLOAD_ROOT: /var/lib/image-hook/uploads
+      IMAGE_UPLOAD_STATE_PATH: /var/lib/image-hook/upload-state.json
       GITEA_WEBHOOK_SECRET_FILE: /run/secrets/gitea_webhook_secret
       IMAGE_ADMIN_SECRET_FILE: /run/secrets/image_admin_secret
       IMAGE_SYNC_CLIENT_SECRET_FILES: core=/run/secrets/image_sync_core_secret,core2026=/run/secrets/image_sync_core2026_secret
+      IMAGE_UPLOAD_CLIENT_SECRET_FILES: core=/run/secrets/image_upload_core_secret,core2026=/run/secrets/image_upload_core2026_secret
+      MAX_UPLOAD_BYTES: "51200"
     volumes:
       - type: bind
         source: ${IMAGE_REPOSITORY_PATH:-.}
@@ -31,6 +35,8 @@ services:
       - image_admin_secret
       - image_sync_core_secret
       - image_sync_core2026_secret
+      - image_upload_core_secret
+      - image_upload_core2026_secret
     tmpfs:
       - /tmp:size=16m,mode=1777
     cap_drop: [ALL]
@@ -50,7 +56,7 @@ services:
   image-web:
     build:
       context: ./deploy/nginx
-    image: sam-image-web:1.1.0
+    image: sam-image-web:1.2.0
     restart: unless-stopped
     depends_on:
       image-hook:
@@ -65,6 +71,10 @@ services:
         source: ${IMAGE_REPOSITORY_PATH:-.}
         target: /srv/image
         read_only: true
+      - type: bind
+        source: ./runtime-data/uploads
+        target: /srv/user-icons
+        read_only: true
     tmpfs:
       - /tmp:size=8m,mode=1777
     cap_drop: [ALL]
@@ -95,3 +105,7 @@ secrets:
     file: ${IMAGE_SYNC_CORE_SECRET_FILE:-./secrets/image_sync_core_secret}
   image_sync_core2026_secret:
     file: ${IMAGE_SYNC_CORE2026_SECRET_FILE:-./secrets/image_sync_core2026_secret}
+  image_upload_core_secret:
+    file: ${IMAGE_UPLOAD_CORE_SECRET_FILE:-./secrets/image_upload_core_secret}
+  image_upload_core2026_secret:
+    file: ${IMAGE_UPLOAD_CORE2026_SECRET_FILE:-./secrets/image_upload_core2026_secret}