Raise avatar cap 64 to 128 KiB, pipeline checks encoded size

64 KiB rejected normal 128px PNGs. 128 KiB fits any 128x128 PNG
(raw <= 64 KiB, worst-case base64 ~95 KiB chars) while still
bounding abuse. PNG kept for transparency. Pipeline now measures
the encoded base64 against RelayConstants (was checking the wrong
variable with its own 512 KiB limit) and drops dead crop code.
Server policy, still v4. Trade noted: avatars ride the 1 Hz room
broadcast, uplink scales with cap; hash-reference follow-up later.

packages/core/lib/src/constants.dart

@@ -15,7 +15,13 @@ abstract class RelayConstants {
   static const int stateHeartbeatSecs = 1;
   static const int pingIntervalSecs = 5;
 
-  static const int maxAvatarBytes = 64 * 1024;
+  // Base64-char count of the avatar string, enforced at hello. Sized so
+  // ANY 128x128 pipeline PNG always fits (raw bitmap <= 64 KiB, worst-case
+  // PNG ~70 KiB raw ~= 95 KiB base64). PNG keeps transparency; JPEG did not.
+  // Trade: avatars ride in the 1 Hz room broadcast, so worst-case host
+  // uplink scales with this cap. Follow-up (not now): send avatar bytes
+  // once, reference by hash afterwards.
+  static const int maxAvatarBytes = 128 * 1024;
   static const int maxNameLength = 32;
   static const int maxChatLength = 500;
 }

packages/server/test/session_test.dart

@@ -43,6 +43,13 @@ void main() {
       expect(() => s.issueToken('alice', big), throwsA(isA<AuthException>()));
     });
 
+    test('64 KiB avatar accepted under raised cap', () {
+      final s = Session(id: 'default', secret: 'shh');
+      final png = 'x' * (64 * 1024);
+      expect(s.issueToken('alice', png), isNotEmpty);
+      expect(s.tokens.values.single.avatar, hasLength(64 * 1024));
+    });
+
     test('names truncated to cap, blank becomes ?', () {
       final s = Session(id: 'default', secret: 'shh');
       final long = s.issueToken('a' * 100, '');