feat: add signed bind-backed user icon uploads

deploy/nginx/templates/default.conf.template

@@ -69,6 +69,18 @@ http {
         proxy_request_buffering on;
     }
 
+    location ^~ /v1/uploads/user-icons/ {
+        limit_except PUT { deny all; }
+        client_max_body_size 50k;
+        proxy_pass http://image-hook:8081;
+        proxy_set_header Host $host;
+        proxy_set_header X-Image-Client $http_x_image_client;
+        proxy_set_header X-Image-Expires $http_x_image_expires;
+        proxy_set_header X-Image-Request-Id $http_x_image_request_id;
+        proxy_set_header X-Image-Signature $http_x_image_signature;
+        proxy_request_buffering on;
+    }
+
     location ^~ /v1/admin/ { return 404; }
     location = /image { return 404; }
     location = /image/ { return 404; }
@@ -80,6 +92,15 @@ http {
         add_header X-Content-Type-Options nosniff always;
     }
 
+    location ^~ /icons/users/ {
+        alias /srv/user-icons/;
+        etag on;
+        expires 1y;
+        add_header Cache-Control "public, immutable" always;
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header X-Content-Type-Options nosniff always;
+    }
+
     location ^~ /icons/ {
         try_files $uri =404;
         add_header Access-Control-Allow-Origin "*" always;

deploy/scripts/init-secrets.sh

@@ -9,7 +9,8 @@ state_dir="$repository_dir/runtime-data"
 umask 077
 mkdir -p "$secret_dir"
 mkdir -p "$state_dir"
-for name in gitea_webhook_secret image_admin_secret image_sync_core_secret image_sync_core2026_secret; do
+mkdir -p "$state_dir/uploads"
+for name in gitea_webhook_secret image_admin_secret image_sync_core_secret image_sync_core2026_secret image_upload_core_secret image_upload_core2026_secret; do
     path="$secret_dir/$name"
     if [ ! -e "$path" ]; then
         openssl rand -hex 32 > "$path"
@@ -17,5 +18,6 @@ for name in gitea_webhook_secret image_admin_secret image_sync_core_secret image
     chmod 600 "$path"
 done
 chmod 700 "$state_dir"
+chmod 755 "$state_dir/uploads"
 
 echo "Secret files are ready in $secret_dir (values not printed)."