Client avatars, and Robert Pérez on the demo account

`users.image` was null on every seeded customer, and it is the face on
every review a pro has — `pro.reviews` selects it as `authorImage` — as
well as the chat header. So the one screen meant to prove other people
have used this rendered as a column of blank circles.

Five customers now carry a portrait, seeded with the source url and
rewritten to the bucket like pro_media, and the first of them — the
dev-login account the demo signs in as — is Robert Pérez.

assets:migrate only knew about pro_media and job photos, so an avatar
would have stayed on someone else's CDN indefinitely. It has a users
pass now, which also catches the provider avatar a social sign-in writes
straight onto the row.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/api/src/context.ts

@@ -17,6 +17,16 @@ export interface Session {
   phone: string | null;
   /** Only present for pros. Gates the procedures that require a live, verified pro. */
   verificationStatus: VerificationStatus | null;
+  /**
+   * Which session row this request arrived on, so the security screen can say
+   * "this device" and mean it.
+   *
+   * Optional because not every caller has one: the server-side caller and the
+   * test fakes construct a session directly, with no row behind it. Anything
+   * reading this must treat "absent" as "cannot tell", never as "not current" —
+   * marking the wrong device as the current one is worse than marking none.
+   */
+  sessionId?: string;
 }
 
 /**

packages/api/src/routers/user.ts

@@ -364,7 +364,14 @@ export const userRouter = router({
       .orderBy(desc(schema.sessions.createdAt));
 
     // sessions.token is a live bearer credential and is deliberately not selected.
-    return rows.map((r) => ({ ...r, isImpersonated: r.impersonatedBy !== null }));
+    return rows.map((r) => ({
+      ...r,
+      isImpersonated: r.impersonatedBy !== null,
+      // False when the caller has no session id rather than guessing. A device
+      // list that mislabels which one you are holding is worse than one that
+      // labels none of them.
+      isCurrent: ctx.session.sessionId !== undefined && r.id === ctx.session.sessionId,
+    }));
   }),
 
   /**