Fix: prevent goroutine leak in avatar fetch (CVE-2026-21720)

[credativ-marco]

No description provided.

[credativ-marco]

Motivation/some more explanation:
The idea is, to put the whole connection into a context. Previously, if a user disconnected, e.g. by closing the browser or intentionally for an attack, while their profile picture was being fetched, the server's background processes would hang indefinitely and could exhausting the server's RAM. By introducing the context, the patch should ensure that the moment a connection is being dropped, all associated background tasks and external network requests are immediately aborted and the memory is cleanly released.