feat(nativeapi): add user avatar upload and delete endpoints

Adds POST/DELETE /api/user/{id}/image, gated by EnableUserAvatarUpload
(never EnableArtworkUpload) and restricted to the target user or an
admin. Reuses the artist/playlist/radio image-upload handlers via a new
gate opt-out so their EnableArtworkUpload behavior is unchanged.

server/nativeapi/users.go

@@ -0,0 +1,87 @@
+package nativeapi
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/deluan/rest"
+	"github.com/go-chi/chi/v5"
+	"github.com/navidrome/navidrome/conf"
+	"github.com/navidrome/navidrome/model"
+	"github.com/navidrome/navidrome/model/request"
+	"github.com/navidrome/navidrome/server"
+)
+
+func (api *Router) addUserRoute(r chi.Router) {
+	constructor := func(ctx context.Context) rest.Repository {
+		return api.users.NewRepository(ctx)
+	}
+	r.Route("/user", func(r chi.Router) {
+		r.Get("/", rest.GetAll(constructor))
+		r.Post("/", rest.Post(constructor))
+		r.Route("/{id}", func(r chi.Router) {
+			r.Use(server.URLParamsMiddleware)
+			r.Get("/", rest.Get(constructor))
+			r.Put("/", rest.Put(constructor))
+			r.Delete("/", rest.Delete(constructor))
+			r.Post("/image", api.uploadUserAvatar())
+			r.Delete("/image", api.deleteUserAvatar())
+		})
+	})
+}
+
+// canEditAvatar allows the target user or any admin, and honors the feature flag for everyone.
+func canEditAvatar(ctx context.Context, targetID string) error {
+	if !conf.Server.EnableUserAvatarUpload {
+		return model.ErrNotAuthorized
+	}
+	usr, _ := request.UserFrom(ctx)
+	if !usr.IsAdmin && usr.ID != targetID {
+		return model.ErrNotAuthorized
+	}
+	return nil
+}
+
+func (api *Router) uploadUserAvatar() http.HandlerFunc {
+	// false: avatars are gated by EnableUserAvatarUpload, never by EnableArtworkUpload.
+	return handleImageUploadGated(false, func(ctx context.Context, reader io.Reader, ext string) error {
+		userID := chi.URLParamFromCtx(ctx, "id")
+		if err := canEditAvatar(ctx, userID); err != nil {
+			return err
+		}
+		usr, err := api.ds.User(ctx).Get(userID)
+		if err != nil {
+			if errors.Is(err, model.ErrNotFound) {
+				return model.ErrNotFound
+			}
+			return err
+		}
+		filename, err := api.imgUpload.SetAvatar(ctx, usr.ID, usr.UserName, usr.UploadedImagePath(), reader, ext)
+		if err != nil {
+			return err
+		}
+		return api.ds.User(ctx).UpdateImage(usr.ID, filename)
+	})
+}
+
+func (api *Router) deleteUserAvatar() http.HandlerFunc {
+	return handleImageDeleteGated(false, func(ctx context.Context) error {
+		userID := chi.URLParamFromCtx(ctx, "id")
+		if err := canEditAvatar(ctx, userID); err != nil {
+			return err
+		}
+		usr, err := api.ds.User(ctx).Get(userID)
+		if err != nil {
+			if errors.Is(err, model.ErrNotFound) {
+				return model.ErrNotFound
+			}
+			return err
+		}
+		if err := api.imgUpload.RemoveImage(ctx, usr.UploadedImagePath()); err != nil {
+			return err
+		}
+		return api.ds.User(ctx).UpdateImage(usr.ID, "")
+	})
+}