fix(user): delete avatar file from disk when user account is deleted (#4485)

AvatarUploader::remove() was never called during user deletion, leaving
avatar files as orphans on the flarum-avatars disk. Every deleted user
with a custom avatar accumulated a stranded file indefinitely.

Hook into the existing deleting observer (pre-delete, so the avatar_url
attribute is still readable) and delete the file directly from the
filesystem. Uses getRawOriginal() to get the stored path rather than
the accessor, which would return a full URL.

Fixes #4459

Author: imorland

framework/core/src/User/User.php

@@ -151,6 +151,16 @@ public static function boot()
             if ($user->id == 1) {
                 throw new DomainException('Cannot delete the root admin');
             }
+
+            $avatarPath = $user->getRawOriginal('avatar_url');
+
+            if ($avatarPath) {
+                $disk = resolve(Factory::class)->disk('flarum-avatars');
+
+                if ($disk->exists($avatarPath)) {
+                    $disk->delete($avatarPath);
+                }
+            }
         });
 
         static::deleted(function (self $user) {