docs: correct root-cause comment on avatar CORS investigation

The OSS bucket's CORS rule does allow the app's auth headers -- just
scoped to the real web/web1-5.118im.com origins. The earlier failure
was from testing against a local dev origin, never in any CORS
whitelist, not from OSS lacking CORS entirely.

web/src/app/Avatar.tsx

@@ -26,13 +26,15 @@ interface AvatarProps {
  * back as an ALREADY-COMPLETE OSS URL in this same field (e.g.
  * "https://im-oss-t1.oss-cn-shenzhen.aliyuncs.com/im-assets/default-avatars/male/4.png"). A first
  * fix attempt stopped re-wrapping that URL into the malformed "/v0/file/s/https://..." shape but
- * still routed it through `useAuthedBlobUrl`'s authenticated fetch -- live-confirmed that still
- * fails: this OSS bucket's default-avatar path serves plain public assets with no CORS headers at
- * all, so a cross-origin fetch carrying the app's auth headers (Bearer token, API key -- meaningless
- * to OSS anyway) gets blocked at the preflight, `useAuthedBlobUrl` reports an error, and the tile
- * falls back to the plain letter. An absolute URL never needs the authenticated-fetch-to-blob dance
- * (that mechanism exists only to attach credentials `/v0/file/s/{id}` requires) -- render it directly
- * as a plain `<img src>` instead, same as any other publicly-loadable image.
+ * still routed it through `useAuthedBlobUrl`'s authenticated fetch, which then failed when tested
+ * from a local dev origin -- turned out to be a false lead: the OSS bucket's CORS rule (checked
+ * directly in the Aliyun console) DOES allow this app's auth headers, just scoped to the real
+ * `web/web1-5.118im.com` origins, which a local dev server was never going to match regardless of
+ * bucket config (same class of mistake this codebase has hit before testing OSS URLs from
+ * localhost). The actual reason to skip `useAuthedBlobUrl` for an absolute URL isn't "CORS is
+ * broken" -- it's that the auth headers it attaches are meaningless to OSS for a public asset in the
+ * first place, so the fetch-to-blob round trip (plus its preflight) is pure overhead; render the URL
+ * directly as a plain `<img src>` instead, same as any other publicly-loadable image.
  */
 export function Avatar({ id, name, avatarFileId, className = '', fallbackBgClass }: AvatarProps) {
   const isAbsoluteUrl = !!avatarFileId && /^https?:\/\//.test(avatarFileId);