fix(auth): derive avatar extension from type

[aiirvizionz]

Summary

• derive stored avatar file extensions from the already-validated MIME type
• avoid trusting the original uploaded filename extension for storage paths
• add a regression test for a PNG upload submitted with a misleading .php filename

Test

• node node_modules\vitest\vitest.mjs run --config %TEMP%\qryptchat-vitest-minimal.config.mjs "src/app/api/auth/upload-avatar/route.test.js"
• git diff --check

uGig billing

• Expected invoice: 0.50 USD if accepted/merged
• Counted as revenue now: no, pending review/payment