Avatar photo uploads and a global handbrake for the agent engine

Two operator asks, one review gate:

Avatar portraits (migration 052): the avatar editor gains "Upload
photo" - the renderer downscales the chosen picture to a ~96px cover
crop and stores it as a small data URL (PNG keeps transparency, the
rest compresses to JPEG), so the snapshot stays light and the CSP needs
nothing new. The portrait wins over emoji and initials everywhere the
shared Avatar renders (chat, org chart, office card, sidebar), and
"Remove photo" falls back cleanly. The main process validates scheme
and size (base64 image data URL, <=300k chars) so a rogue caller cannot
re-bloat the snapshot. e2e uploads a real PNG through the profile
dialog and sees the portrait land in the sidebar.

Global pause (migration 053): when agents start talking in circles,
one topbar toggle - visible on every page - pulls the handbrake.
app_state.autorun_paused survives restarts; the queue worker checks it
each tick and neither enqueues nor claims while set (the run already in
flight finishes). Queued work simply waits and the paused state renders
as an amber "resume" pill. A unit test drives the real worker: paused
leaves a queued run untouched through many ticks, resuming claims it
within moments; e2e flips the toggle in the live shell.

src/main/app/task-queue-worker.ts

@@ -16,6 +16,13 @@ export interface QueuedRun {
   org_id: string;
 }
 
+/** True while the operator has pulled the global autonomous handbrake. */
+export function isAutonomousPaused(connection: DatabaseConnection): boolean {
+  const row = connection.db.prepare("select autorun_paused from app_state where id = 1")
+    .get() as { autorun_paused: number } | undefined;
+  return row?.autorun_paused === 1;
+}
+
 /**
  * Atomically claims the oldest queued task_run by transitioning it
  * `queued` -> `running` in one transaction; returns the claimed run or null.
@@ -48,11 +55,20 @@ export function startTaskQueueWorker(input: TaskQueueWorkerInput): () => void {
   const taskExecution = new TaskExecutionService(input.connection.db, undefined, undefined, notifyDataChanged);
   const intervalMs = input.intervalMs ?? DEFAULT_INTERVAL_MS;
   let running = false;
+  let wasPaused = false;
 
   const tick = async (): Promise<void> => {
     if (running) return;
     running = true;
     try {
+      // The operator's global pause parks the whole engine: nothing new is
+      // enqueued or claimed until they resume. Queued work simply waits.
+      const paused = isAutonomousPaused(input.connection);
+      if (paused !== wasPaused) {
+        console.info(paused ? "[task-queue] paused by the operator; no new runs start." : "[task-queue] resumed by the operator.");
+        wasPaused = paused;
+      }
+      if (paused) return;
       const enqueued = input.connection.transaction(() => taskExecution.enqueueHeartbeatRuns());
       const claimed = claimNextQueuedRun(input.connection);
       if (!claimed) {