fix: append apikey to avatar public URL for self-hosted Supabase

Self-hosted Supabase Kong requires apikey param even for public bucket
URLs. Without it, browsers get 401 when loading the image.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/avatar.php

@@ -94,7 +94,7 @@ if ($httpCode >= 400) {
     jsonError('Storage error (' . $httpCode . '): ' . ($decoded['message'] ?? $decoded['error'] ?? $response), 500);
 }
 
-$publicUrl = SUPABASE_STORAGE . '/object/public/' . $bucket . '/' . $storagePath;
+$publicUrl = SUPABASE_STORAGE . '/object/public/' . $bucket . '/' . $storagePath . '?apikey=' . SUPABASE_ANON_KEY;
 
 $db = supabaseService();
 $result = $db->update('profiles', ['avatar_url' => $publicUrl], ['id' => 'eq.' . $userId]);