fix: harden avatar upload path and sync review truth

internal/api/handler/avatar_handler_path_test.go

@@ -0,0 +1,33 @@
+package handler
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestResolveAvatarUploadDir_DefaultRootBecomesAbsolute(t *testing.T) {
+	dir, err := resolveAvatarUploadDir("")
+	if err != nil {
+		t.Fatalf("resolveAvatarUploadDir() error = %v", err)
+	}
+	if !filepath.IsAbs(dir) {
+		t.Fatalf("resolveAvatarUploadDir() = %q, want absolute path", dir)
+	}
+	if !strings.HasSuffix(filepath.ToSlash(dir), "/uploads/avatars") {
+		t.Fatalf("resolveAvatarUploadDir() = %q, want suffix /uploads/avatars", dir)
+	}
+}
+
+func TestResolveAvatarUploadDir_CustomRootPreserved(t *testing.T) {
+	dir, err := resolveAvatarUploadDir("testdata/uploads-root")
+	if err != nil {
+		t.Fatalf("resolveAvatarUploadDir() error = %v", err)
+	}
+	if !filepath.IsAbs(dir) {
+		t.Fatalf("resolveAvatarUploadDir() = %q, want absolute path", dir)
+	}
+	if !strings.HasSuffix(filepath.ToSlash(dir), "/testdata/uploads-root/avatars") {
+		t.Fatalf("resolveAvatarUploadDir() = %q, want custom root suffix", dir)
+	}
+}