fix: add file-type and size validation to avatar upload with toast notifications

[waterWang]

Summary

Replace native alert() calls with toast.error() for avatar upload validation errors, reject SVG uploads (XSS security risk), and add WebP support for the accepted file types.

Changes

ProfileTab.tsx

• File type validation: Reject SVG uploads (security — XSS vector via embedded <script>). Allowed types: PNG, JPG, GIF, WebP
• Error feedback: Use toast.error() instead of alert() so errors are consistent with the app's existing notification system
• Accept attribute: Updated <input accept="..."> to match validated types

ProfileTab.test.tsx

• Added test: SVG file upload shows error toast with SVG-specific message
• Added test: Oversized file (>5MB) shows error toast with size limit message
• Added test: Valid PNG file upload does not show error toast and reveals Save Picture button

Closes #509