Store Google avatar bytes and slim the session JWT to id only.

Download profile images on login into picturebinary, return them as base64 from /auth/me, and resolve sessions via getById.

src/util/pictureBinary.js

@@ -0,0 +1,31 @@
+/**
+ * Normalize mssql / Node binary values to a non-empty Buffer, or null.
+ * @param {unknown} value
+ * @returns {Buffer | null}
+ */
+export function toPictureBuffer(value) {
+    if (value == null) return null;
+    if (Buffer.isBuffer(value)) return value.length ? value : null;
+    if (value instanceof Uint8Array) return value.length ? Buffer.from(value) : null;
+    return null;
+}
+
+/**
+ * Download a Google profile image URL to a Buffer.
+ * @param {string} url
+ * @returns {Promise<Buffer>}
+ */
+export async function downloadPicture(url) {
+    const res = await fetch(url);
+    if (!res.ok) {
+        throw new Error(`profile picture download failed: ${res.status}`);
+    }
+    const buf = Buffer.from(await res.arrayBuffer());
+    if (!buf.length) {
+        throw new Error('profile picture download failed: empty body');
+    }
+    if (buf.length > 1_000_000) {
+        throw new Error('profile picture too large');
+    }
+    return buf;
+}