fix(imaging): normalise avatar figures before building URLs

Legacy accounts can carry a malformed stored look — the old register default
`hr-100-.hd-180-1...` has an empty colour slot — which the imager rejects with
400 "Invalid figure format", so the avatar renders broken everywhere the look
appears. Normalise the figure in the shared URL builder (`getAvatarUrl`, used by
every avatar on the site): an unrenderable look becomes `DEFAULT_AVATAR_FIGURE`
while the proxy route keeps rejecting malformed input with 400.

The rule set and default now live in one client-safe module
(`src/lib/avatar-figure.ts`), shared by the URL builder and the server parser.

src/actions/register.ts

@@ -5,6 +5,7 @@ import { after } from "next/server";
 import { z } from "zod";
 import { sendVerification } from "@/lib/auth/email-verification";
 import { hashPassword } from "@/lib/auth/password";
+import { DEFAULT_AVATAR_FIGURE } from "@/lib/avatar-figure";
 import { invalidateKey } from "@/lib/cached-db";
 import { db, User } from "@/lib/db";
 import { logger } from "@/lib/logger";
@@ -169,10 +170,10 @@ const ZOD_MESSAGE_CODES: Record<string, RegisterErrorCode> = {
 };
 
 // A valid starter Habbo figure so the avatar renders in-client immediately.
-// The hair part needs a colour slot (`hr-100-1`, not `hr-100-`) or the imager
-// rejects the whole figure with 400 "Invalid figure format" and every avatar
-// for the user renders broken.
-const DEFAULT_LOOK = "hr-100-1.hd-180-1.ch-255-66.lg-280-110.sh-305-62";
+// Shared with the imager URL builder, which normalises malformed stored looks
+// to the same figure (the hair part needs a colour slot: `hr-100-1`, not
+// `hr-100-`).
+const DEFAULT_LOOK = DEFAULT_AVATAR_FIGURE;
 
 export interface RegisterState {
 	error: string | null;