feat(app): wire missing fe/be flows

[risu729]

Summary

• add typed app mutations for profile updates, avatar uploads, saved stickers, and POI visits
• preserve the redesigned map and auth frontend while wiring the HUD and profile modal to live user/progress data
• persist username and avatar edits and return a 409 for duplicate usernames
• send custom sticker names to the API and return/invalidate quest progress after sticker saves
• add web and native POI check-in actions using the current Expo Location position
• render the persisted avatar across profile and map surfaces
• pin TypeScript 5.9 across workspaces to eliminate CI-only compiler drift

Review hardening

• expose the full profile/name/avatar editor from the map profile sheet
• keep native POI callouts synchronized after check-in and avoid unrelated Leaflet rebuilds
• normalize uploaded avatars to 64x64 and validate PNG size/header/dimensions in the API
• detect PostgreSQL unique violations through Drizzle's wrapped cause chain
• serialize saved-sticker capacity checks, inserts, and quest progress in one transaction
• stop logging mutation bodies containing avatar or sticker base64
• reset optimistic local identity on sign-out
• add API regression tests and run them in CI

Rebase update

• rebased onto the latest main after feat(app): redesign auth — pixel-art landing, login, register, verify screens #43 and Map redesign #44 landed
• resolved map, sticker creator, profile, and auth route conflicts against the redesigned frontend
• kept automatic geofence entry as follow-up work in PLAN.md

Checks

• bun install --frozen-lockfile
• bun run check
• bun run test
• bun run build:app
• bun run build:api