Photo du bénévole ajoutée par la coordination

Section « Photo » sur la fiche bénévole (ajouter / remplacer / retirer),
PUT/DELETE /editions/{id}/volunteers/{vid}/photo (COORDINATION),
validation de l'image partagée avec le formulaire public (read_photo).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/tests/test_api_volunteers.py

@@ -609,3 +609,50 @@ def test_export_gives_the_sumup_transaction(client, edition, session):
     assert fiche["fee_transaction_code"] == "TEENSK4W2K"
     # L'identifiant du checkout, lui, reste interne.
     assert "fee_checkout_id" not in fiche
+
+
+def _png() -> bytes:
+    from PIL import Image
+
+    out = io.BytesIO()
+    Image.new("RGB", (4, 4), "red").save(out, format="PNG")
+    return out.getvalue()
+
+
+def test_coordinator_adds_then_removes_a_volunteer_photo(client, edition, session):
+    volunteer = make_volunteer(session, edition)
+    url = _url(edition, f"/{volunteer.id}/photo")
+    assert client.get(url).status_code == 404
+
+    resp = client.put(url, files={"file": ("photo.png", _png(), "image/png")})
+    assert resp.status_code == 200
+    assert resp.json()["has_photo"] is True
+    photo = client.get(url)
+    assert photo.status_code == 200
+    assert photo.headers["content-type"] == "image/png"
+
+    resp = client.delete(url)
+    assert resp.status_code == 200
+    assert resp.json()["has_photo"] is False
+    assert client.get(url).status_code == 404
+
+
+def test_adding_a_fake_photo_is_rejected(client, edition, session):
+    volunteer = make_volunteer(session, edition)
+    resp = client.put(
+        _url(edition, f"/{volunteer.id}/photo"),
+        files={"file": ("photo.png", b"pas une image", "image/png")},
+    )
+    assert resp.status_code == 422
+    assert resp.json()["detail"]["code"] == "form.photo_type_not_supported"
+
+
+def test_only_the_coordination_can_change_a_photo(
+    session, edition, make_account, as_account
+):
+    volunteer = make_volunteer(session, edition)
+    lead = as_account(make_account(Role.LEAD, email="lead@e.fr"))
+    url = _url(edition, f"/{volunteer.id}/photo")
+
+    assert lead.put(url, files={"file": ("p.png", _png(), "image/png")}).status_code == 403
+    assert lead.delete(url).status_code == 403