fix(imaging): keep avatars rendering, cacheable and reliably timed

Effect renders need a little over 4s, which the 4s primary timeout cut off,
so every avatar with the default effect fell through to an unreachable
public fallback and rendered as a placeholder. Raise the primary budget
above the observed render cost and shorten the fallback budget.

Also stop the proxy from stamping no-store over the avatar and media
responses, so browsers keep the long-lived Cache-Control the route already
sends, and recreate the imaging cache directories with the container user
on every deploy, since root ownership made those cache writes fail
silently.

scripts/ci-deploy.sh

@@ -146,6 +146,15 @@ if [ "$previous_name" != epicnext-cms-app ] && [ "$secondary_name" != epicnext-c
 fi
 
 cutover_started=1
+# The avatar/badge disk cache lives on the host bind and is written by uid 33
+# inside the container. Root-owned directories make every cache write fail
+# silently, which turns each avatar into a fresh live render.
+for cache_dir in avatars badges; do
+  if ! install -d -o 33 -g 33 -m 0750 "$deploy_dir/storage/imaging/$cache_dir" 2>/dev/null; then
+    mkdir -p "$deploy_dir/storage/imaging/$cache_dir" 2>/dev/null || true
+  fi
+done
+chown -R 33:33 "$deploy_dir/storage/imaging" 2>/dev/null || true
 # Both legacy Compose and CI containers can exist after earlier failed updates.
 # Preserve each before releasing the shared host port; never kill an arbitrary PID.
 if [ -n "$secondary_name" ]; then