Users can upload and remove profile pictures on the profile page. Admins choose local or instance S3 storage in advanced settings. Avatars are compressed to JPEG and served via a private cached route.
