fix(web): upgrade http OSS URLs to https to fix mixed-content block

Aliyun OSS sometimes returns presigned URLs as http:// even though every
page here is served over https:// -- the browser silently blocks these
as mixed content, which is why images (e.g. avatar) failed to display
after upload. Added upgradeToHttps() and wired it into fileDownloadUrl()
(the single chokepoint every image/attachment fetch in the app resolves
through) plus the three chat-attachment send paths, so both freshly
fetched and newly-persisted URLs get the scheme fix.

Also fixed ProfileSettingsPage's avatar upload handler, which extracted
the file id by parsing the upload response's `url` with .split('/').pop()
instead of just reading the `file_id` field the response already
provides -- fragile against exactly this kind of full-URL response and
the most likely actual trigger for the reported bug.

vite.config.ts: dev server port now respects $PORT if set, falls back
to 8094 -- unrelated cleanup, needed it to run a second local dev
server for verification alongside another concurrent session's.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/features/settings/ProfileSettingsPage.tsx

@@ -85,9 +85,8 @@ export function ProfileSettingsPage() {
   const avatarMutation = useMutation({
     mutationFn: async (file: File) => {
       const uploaded = await uploadFile(file);
-      const fileId = uploaded.url.split('/').pop() || '';
       if (!query.data) throw new Error('尚未加载');
-      return updateMyProfile({ avatar_file_id: fileId, version: query.data.version });
+      return updateMyProfile({ avatar_file_id: uploaded.file_id, version: query.data.version });
     },
     onSuccess: (data) => {
       queryClient.setQueryData(['my-profile'], (prev: typeof query.data) => (prev ? { ...prev, ...data } : data));