fix(migration): Ref 전용 아이콘을 업로드 API로 이관한다

전용 아이콘 바이트를 모두 검증한 뒤 sam-image 서명 API에 결정적 경로로 등록한다. API 반환 경로를 계정과 아이콘 소유 목록에 연결하고 Core에서 바뀐 현재 선택은 보존한다.

tools/legacy-db-migration/test/config.test.ts

@@ -17,6 +17,8 @@ const writeFixture = async (mode = 0o600): Promise<string> => {
     const directory = await mkdtemp(path.join(os.tmpdir(), 'sammo-legacy-plan-'));
     workDirectories.push(directory);
     await writeFile(path.join(directory, 'mysql-password'), 'secret-value\n', { mode: 0o600 });
+    await writeFile(path.join(directory, 'image-upload-secret'), `${'u'.repeat(32)}\n`, { mode: 0o600 });
+    const iconDirectory = await mkdtemp(path.join(directory, 'icons-'));
     const configPath = path.join(directory, 'migration-plan.json');
     await writeFile(
         configPath,
@@ -30,6 +32,12 @@ const writeFixture = async (mode = 0o600): Promise<string> => {
                     user: 'migration_reader',
                     passwordFile: './mysql-password',
                 },
+                userIcons: {
+                    sourceDirectory: iconDirectory,
+                    uploadBaseUrl: 'https://sam-image.hided.net',
+                    publicBaseUrl: 'https://sam-image.hided.net/icons',
+                    uploadSecretFile: './image-upload-secret',
+                },
                 targetUrlEnv: 'TEST_GATEWAY_DATABASE_URL',
             },
         }),
@@ -51,6 +59,11 @@ describe('legacy migration plan config', () => {
         expect(source.username).toBe('migration_reader');
         expect(source.password).toBe('secret-value');
         expect(plan.stages[0]!.sourceIdentity.key).toBe('fixture-cutover:gateway');
+        expect(plan.stages[0]!.userIcons).toMatchObject({
+            uploadBaseUrl: 'https://sam-image.hided.net',
+            publicBaseUrl: 'https://sam-image.hided.net/icons',
+            uploadSecret: 'u'.repeat(32),
+        });
     });
 
     it('rejects a config readable by group or other users', async () => {