Mini API: avatar, wallet payout/withdraw, stale-payment auto-cancel.

Adds account avatar upload (multipart proxy to identity), wallet payout-account
+ withdrawal endpoints, and a hourly mini:cancel-stale-payments command that
cancels payments pending beyond 6h (new MiniPayment::STATUS_CANCELED).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Http/Controllers/Api/Mini/AccountController.php

@@ -7,6 +7,7 @@ use App\Http\Controllers\Controller;
 use App\Models\QrSetting;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Http;
 
 class AccountController extends Controller
 {
@@ -89,6 +90,34 @@ class AccountController extends Controller
         ]);
     }
 
+    public function uploadAvatar(Request $request): JsonResponse
+    {
+        $account = ladill_account();
+
+        $request->validate([
+            'avatar' => ['required', 'image', 'mimes:jpg,jpeg,png,webp', 'max:4096'],
+        ]);
+
+        $file = $request->file('avatar');
+
+        $response = Http::baseUrl(rtrim((string) config('services.ladill_identity.url'), '/'))
+            ->withToken((string) config('services.ladill_identity.key'))
+            ->acceptJson()
+            ->attach('avatar', (string) file_get_contents($file->getRealPath()), $file->getClientOriginalName())
+            ->post('/api/identity/avatar', ['user' => $account->public_id]);
+
+        $this->rethrowValidation($response, 'avatar');
+
+        if ($response->successful()) {
+            $picture = (string) $response->json('data.user.picture', '');
+            if ($picture !== '') {
+                $account->update(['avatar_url' => $picture]);
+            }
+        }
+
+        return response()->json(['data' => ['avatar_url' => $account->fresh()->avatarUrl()]]);
+    }
+
     public function changePassword(Request $request): JsonResponse
     {
         $account = ladill_account();