fix(web): 第9轮审查批次4——设置域一批问题

- 头像上传从未带purpose=user_avatar：之前是照抄一个已经修复的旧后端
  bug(问题28)绕开的写法，现在确认接口早就支持这个purpose了，补上——
  uploadFile()新增可选purpose参数，不影响其它已有调用点(聊天附件/群
  文件继续用topic的chat_file路径)
- 桌面卡片行分隔线6处错用了移动端专属的border-list-item token，改成
  桌面正确的border-row
- 退出登录按钮外边距/设置目录导航图标尺寸(18px→20px)与设计稿对齐
- 地区字段补上maxLength兜底
- 修改密码没有用<form>包裹，输入框按回车没反应——补上表单+onSubmit
- 记录一条此前没进清单的后端缺口："加我为好友时需要验证"这个隐私开关
  设计稿画了，但响应体里根本没有对应字段

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/lib/api/upload.ts

@@ -36,13 +36,22 @@ const UPLOAD_CTRL_TEXT_CN: Record<string, string> = {
   'not found': '内容不存在或已被删除',
 };
 
-export async function uploadFile(file: File, topic?: string): Promise<UploadedFile> {
+/**
+ * `purpose` only matters when `topic` is omitted (a chat/group-file upload always sends
+ * `chat_file` regardless) -- currently just the avatar upload path, which used to send no
+ * `purpose` at all. That omission dated back to this same endpoint's `purpose=user_avatar` 400ing
+ * (docs/IM-后端问题清单.md 问题28) -- confirmed since fixed (a real PNG upload with that purpose
+ * now returns 200), so there's no reason left to omit it.
+ */
+export async function uploadFile(file: File, topic?: string, purpose?: string): Promise<UploadedFile> {
   const form = new FormData();
   form.append('file', file);
   form.set('id', getTinode().getNextUniqueId());
   if (topic) {
     form.append('purpose', 'chat_file');
     form.append('topic', topic);
+  } else if (purpose) {
+    form.append('purpose', purpose);
   }
   const res = await fetch(`${fileBase()}/u/`, {
     method: 'POST',