fix: avatar upload — add missing apikey header for Supabase Storage

Supabase Storage requires both Authorization and apikey headers. The
missing apikey caused "No API key found in request" → 500 on upload.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/avatar.php

@@ -73,6 +73,7 @@ curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 curl_setopt($ch, CURLOPT_POST, true);
 curl_setopt($ch, CURLOPT_HTTPHEADER, [
     'Authorization: Bearer ' . SUPABASE_SERVICE_KEY,
+    'apikey: ' . SUPABASE_ANON_KEY,
     'Content-Type: ' . $mime,
     'x-upsert: true'
 ]);