fix(avatar): sincroniza avatar apos atualizar

- Propaga Set-Cookie do Better Auth no endpoint de avatar\n- Forca refresh da sessao apos upload/remocao\n- Adiciona teste de propagacao e defaults de env para testes

tests/profile-avatar-cookie-propagation.test.ts

@@ -0,0 +1,72 @@
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+import { DELETE } from "@/app/api/profile/avatar/route"
+import { getServerSession } from "@/lib/auth-server"
+import { auth } from "@/lib/auth"
+import { prisma } from "@/lib/prisma"
+
+vi.mock("@/lib/auth-server", () => ({
+  getServerSession: vi.fn(),
+}))
+
+vi.mock("@/server/convex-client", () => ({
+  createConvexClient: vi.fn(() => ({ mutation: vi.fn() })),
+}))
+
+vi.mock("@/lib/prisma", () => ({
+  prisma: {
+    authUser: { update: vi.fn() },
+  },
+}))
+
+vi.mock("@/lib/auth", () => ({
+  auth: {
+    api: {
+      updateUser: vi.fn(),
+    },
+  },
+}))
+
+describe("DELETE /api/profile/avatar", () => {
+  beforeEach(() => {
+    vi.resetAllMocks()
+    vi.mocked(getServerSession).mockResolvedValue({
+      session: { id: "sess-1", expiresAt: Date.now() + 60_000 },
+      user: {
+        id: "user-1",
+        name: "Agente",
+        email: "agent@example.com",
+        role: "agent",
+        tenantId: null,
+        avatarUrl: "https://cdn.example.com/avatar.png",
+        machinePersona: null,
+      },
+    })
+  })
+
+  it("propaga Set-Cookie retornado pelo Better Auth (cookieCache)", async () => {
+    const upstreamHeaders = new Headers()
+    upstreamHeaders.append("set-cookie", "better-auth.session_data=abc; Path=/; HttpOnly")
+    upstreamHeaders.append("set-cookie", "better-auth.session_token=def; Path=/; HttpOnly")
+
+    vi.mocked(auth.api.updateUser).mockResolvedValue(
+      new Response(JSON.stringify({ status: true }), { status: 200, headers: upstreamHeaders })
+    )
+
+    const req = new Request("http://localhost/api/profile/avatar", { method: "DELETE" })
+    const res = await DELETE(req)
+
+    expect(res.status).toBe(200)
+
+    const headersAny = res.headers as Headers & { getSetCookie?: () => string[] | undefined }
+    const setCookies =
+      typeof headersAny.getSetCookie === "function"
+        ? headersAny.getSetCookie() ?? []
+        : [res.headers.get("set-cookie")].filter(Boolean)
+
+    expect(setCookies.join("\n")).toContain("better-auth.session_data=abc")
+    expect(setCookies.join("\n")).toContain("better-auth.session_token=def")
+
+    expect(vi.mocked(prisma.authUser.update)).not.toHaveBeenCalled()
+  })
+})