Clamp the avatar scaler's channels before narrowing them

gosec's G115 failed the security job on v0.50.0's first push: the box
filter narrows uint64 channel sums to uint8. They cannot overflow, since a
premultiplied channel never exceeds its alpha, but the conversion now goes
through to8, which clamps to 16 bits first so that holds by construction
rather than by argument.

No behaviour change, and nothing else in the avatar work moves.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/api/avatars.go

@@ -95,12 +95,19 @@ func boxScale(img image.Image, src image.Rectangle, size int) *image.NRGBA {
 				continue
 			}
 			r, g, b = r/cnt*0xffff/a, g/cnt*0xffff/a, b/cnt*0xffff/a
-			out.SetNRGBA(x, y, color.NRGBA{uint8(r >> 8), uint8(g >> 8), uint8(b >> 8), uint8(a >> 8)})
+			out.SetNRGBA(x, y, color.NRGBA{to8(r), to8(g), to8(b), to8(a)})
 		}
 	}
 	return out
 }
 
+// to8 narrows a 16-bit channel to 8 bits. The clamp is what makes the
+// conversion safe by construction: a premultiplied channel never exceeds its
+// alpha, so it is not expected to bite, but nothing here relies on that.
+func to8(v uint64) uint8 {
+	return uint8(min(v, 0xffff) >> 8)
+}
+
 func handleGetAvatar(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)