MEMBERS-DIRECTORY-001K — Validate saved WebP responses through the Account UI boundary

[daliu]

Closes #639

Officer impact: No live officer workflow changes. In the preserved future My Account interface, clearly mislabeled saved-thumbnail response bytes are rejected before reaching the page, while structurally WebP bytes the browser cannot display keep the existing recoverable Photo unavailable fallback and Remove action.

Officer documentation: SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and the optional member-directory text alternative plus no-terminal evidence-review procedure in docs/officers/EVENTS_SHOP_MEMBERS.md.

Deployment evidence: None. This is source-only response-boundary hardening. memberDirectoryAvailability.ts remains byte-for-byte false; runmprc.com remains the inert #623 artifact; Firebase, providers, accounts, sign-in, production data, and connected-live behavior are unchanged.

Outcome

• Require canonical returned saved-photo bytes to be 12–65,536 bytes with RIFF at bytes 0–3 and WEBP at bytes 8–11.
• Keep malformed responses behind the existing fixed generic response error and out of the Account image/data URL path.
• Preserve the existing version-scoped accessible Photo unavailable fallback and enabled Remove action for structurally admitted bytes that the browser cannot decode.
• Preserve outbound JPEG, PNG, and WebP upload admission and exact bytes.
• Prove the real Account component and real client service compose correctly with only the Firebase Functions transport mocked.
• Add source-only engineering and no-terminal officer evidence documentation.

Evidence

• Base/main: 7877babc96c78f54d11685b4ffb91496c3bf6945
• Head: db1211166f9a7388a40d6197f50f5b52f8d57c36
• Tree: 524cad1dc12025e0adb09fc1c8f4e04caf5fd035
• Exact six-path binary diff SHA-256: 9dcf682311b2a788af65cfade3094ff1979ea55c3ef55343835c3865687a4e35
• Trustworthy RED: 4 targeted cases failed against the old runtime.
• Focused service/component bridge: 42/42 passed.
• Full frontend: 18/18 suites, 1,159/1,159 passed.
• TypeScript, lint baseline, diagnostic build, and git diff --check: passed.
• Workflow/release/security Node suite: 105/105 passed.
• Three independent reviews: GO with no remaining findings.

No component runtime, Account wiring, CSS, admin search, Functions, Rules, index, package, workflow, release-control, provider, account, data, deployment, or live change is included. #507 retains connection/release authority, and active #616 paths/hunk are preserved.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	db12111
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a7e5709e51bec00085f5631
😎 Deploy Preview	https://deploy-preview-640--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.