profile: real avatar upload + storage form fix

- Add a digital-objects client (uploadFile: open session → PUT to
  presigned URL → complete) and a profile client (getProfile,
  updateProfile, pickAvatarUrl variant resolver).
- Wire profile.tsx avatar upload to use the real flow: validate
  image+size, upload to digital_objects tagged "avatar", PATCH
  /api/v1/profile with avatar_digital_object_id, mirror the resolved
  URL into local prefs so the existing <AvatarImage> binding keeps
  working. Show Uploading… state and an inline error banner. Clear
  detaches via avatar_digital_object_id: null.
- Fix the storage form sending the wrong field name for the local
  backend — arcadia's StorageConfig changeset requires `base_path`,
  not `path`. The 422 was silent.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/lib/arcadia/profiles.ts

@@ -0,0 +1,73 @@
+// Arcadia profile API. Backed by /api/v1/profile (current user) — handles
+// avatar wiring (avatar_digital_object_id + variant URLs) and the basic
+// profile fields. The "profile" here is the per-tenant profile row, not
+// the auth account.
+
+import type { ArcadiaClient } from "@crema/arcadia-client"
+
+export interface Profile {
+  id: string
+  user_id: string
+  tenant_id: string
+  avatar_url: string | null
+  avatar_digital_object_id: string | null
+  /**
+   * Variant URLs keyed by size (e.g. "thumbnail", "medium", "original").
+   * Shape depends on the storage backend; treat as best-effort.
+   */
+  avatar_urls?: Record<string, string> | null
+  bio?: string | null
+  phone?: string | null
+  location?: string | null
+  timezone?: string | null
+  inserted_at?: string
+  updated_at?: string
+}
+
+export interface ProfileUpdateInput {
+  avatar_digital_object_id?: string | null
+  bio?: string | null
+  phone?: string | null
+  location?: string | null
+  timezone?: string | null
+}
+
+export async function getProfile(arcadia: ArcadiaClient): Promise<Profile> {
+  const res = await arcadia.GET<{ data: Profile } | Profile>("/api/v1/profile")
+  return "data" in (res as object)
+    ? (res as { data: Profile }).data
+    : (res as Profile)
+}
+
+export async function updateProfile(
+  arcadia: ArcadiaClient,
+  input: ProfileUpdateInput,
+): Promise<Profile> {
+  const res = await arcadia.PATCH<{ data: Profile } | Profile>("/api/v1/profile", {
+    body: { profile: input },
+  })
+  return "data" in (res as object)
+    ? (res as { data: Profile }).data
+    : (res as Profile)
+}
+
+/**
+ * Pick the most appropriate avatar URL from a profile. Prefers a small
+ * variant (thumbnail / small / medium) if available; falls back to
+ * `avatar_url`, then null.
+ */
+export function pickAvatarUrl(profile: Profile | null | undefined): string | null {
+  if (!profile) return null
+  const variants = profile.avatar_urls
+  if (variants && typeof variants === "object") {
+    return (
+      variants.thumbnail ||
+      variants.small ||
+      variants.medium ||
+      variants.original ||
+      profile.avatar_url ||
+      null
+    )
+  }
+  return profile.avatar_url ?? null
+}