feat: avatar moderation — ученик загружает фото, учитель/админ подтверждает или отклоняет

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/db/migrate.js

@@ -2899,6 +2899,25 @@ db.exec(`
 `);
 db.exec('CREATE INDEX IF NOT EXISTS idx_geo_subs_task ON geometry_submissions(task_id)');
 
+// Avatar photo (approved URL, NULL = use initials)
+try { db.exec("ALTER TABLE users ADD COLUMN avatar_url TEXT DEFAULT NULL"); } catch {}
+
+// Avatar moderation queue
+db.exec(`
+  CREATE TABLE IF NOT EXISTS avatar_requests (
+    id          INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id     INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    filename    TEXT    NOT NULL,
+    status      TEXT    NOT NULL DEFAULT 'pending',
+    reviewer_id INTEGER REFERENCES users(id),
+    reject_msg  TEXT,
+    created_at  TEXT    NOT NULL DEFAULT (datetime('now')),
+    reviewed_at TEXT
+  )
+`);
+db.exec('CREATE INDEX IF NOT EXISTS idx_avatar_req_user   ON avatar_requests(user_id)');
+db.exec('CREATE INDEX IF NOT EXISTS idx_avatar_req_status ON avatar_requests(status)');
+
 // User preferences (server-synced: whiteboard defaults, dashboard visibility, etc.)
 db.exec(`
   CREATE TABLE IF NOT EXISTS user_preferences (