Tighten avatar decode and encoded size limits.

Reject images over 1024px before pixel decode, resize down to 512 for storage, and cap re-encoded output at the upload byte limit.

internal/web/helpers_test.go

@@ -42,6 +42,10 @@ func TestPrepareAvatar(t *testing.T) {
 	if err := jpeg.Encode(&jpegBuf, image.NewRGBA(image.Rect(0, 0, 2, 2)), &jpeg.Options{Quality: 90}); err != nil {
 		t.Fatal(err)
 	}
+	var largePNG bytes.Buffer
+	if err := png.Encode(&largePNG, image.NewRGBA(image.Rect(0, 0, 800, 600))); err != nil {
+		t.Fatal(err)
+	}
 
 	oversized := bytes.Repeat([]byte{0x89}, (2<<20)+2)
 
@@ -54,10 +58,12 @@ func TestPrepareAvatar(t *testing.T) {
 	}{
 		{name: "png", in: pngBuf.Bytes(), max: 2 << 20, wantExt: ".png"},
 		{name: "jpeg", in: jpegBuf.Bytes(), max: 2 << 20, wantExt: ".jpg"},
+		{name: "resize large", in: largePNG.Bytes(), max: 2 << 20, wantExt: ".png"},
 		{name: "empty", in: nil, max: 2 << 20, wantErr: "empty"},
 		{name: "invalid", in: []byte("not-an-image"), max: 2 << 20, wantErr: "unsupported"},
 		{name: "oversized", in: oversized, max: 2 << 20, wantErr: "too large"},
 		{name: "huge dims", in: pngWithDims(100000, 100000), max: 2 << 20, wantErr: "dimensions"},
+		{name: "over decode cap", in: pngWithDims(2048, 2048), max: 2 << 20, wantErr: "dimensions"},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
@@ -77,6 +83,16 @@ func TestPrepareAvatar(t *testing.T) {
 			if len(body) == 0 || ct == "" {
 				t.Fatalf("empty output body/ct")
 			}
+			if int64(len(body)) > tc.max {
+				t.Fatalf("encoded size %d exceeds max %d", len(body), tc.max)
+			}
+			cfg, _, err := image.DecodeConfig(bytes.NewReader(body))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if cfg.Width > 512 || cfg.Height > 512 {
+				t.Fatalf("avatar dims %dx%d exceed 512", cfg.Width, cfg.Height)
+			}
 		})
 	}
 }