feat(user-profile): add avatar upload functionality and update UserProfile entity

docs/api/appointment.md

@@ -430,6 +430,7 @@ Role-aware paginated list of appointments. Returns only what the authenticated u
 | `ROLE_CLINIC` | Appointments for doctors in this clinic |
 | `ROLE_DOCTOR` | Appointments for this doctor |
 | `ROLE_SECRETARY` | Appointments for the linked doctor (empty if `appointments.view` permission is false) |
+| (plain patient `ROLE_USER`) | The patient's own appointments (`a.user = current user`) |
 
 ### Query Parameters
 | Param | Type | Default | Description |

docs/api/user-profile.md

@@ -154,3 +154,27 @@ Delete a user profile.
 | `ERR_AUTH_001` | 401 | Missing token |
 | `ERR_AUTH_006` | 403 | Not admin |
 | `ERR_NOT_FOUND_001` | 404 | Profile not found |
+
+---
+
+## POST `/api/v1/user-profile/avatar`
+
+Upload the current user's profile avatar. Creates the profile if it doesn't exist yet.
+
+**Permission:** `IS_AUTHENTICATED_FULLY`
+
+### Request
+Raw file body with `Content-Disposition: filename="..."` and `Content-Type: application/octet-stream`.
+
+### Response `200`
+```json
+{ "success": true, "data": { "avatar": "/uploads/avatars/2026-06/xxx.jpg", "url": "/uploads/avatars/2026-06/xxx.jpg" } }
+```
+
+The stored path is also returned as `avatar` in the profile GET/PATCH responses.
+
+### Errors
+| Code | HTTP | Description |
+|------|------|-------------|
+| `ERR_VALIDATION_001` | 422 | Missing or invalid file |
+| `ERR_AUTH_001` | 401 | Missing token |