object storage + full permission system + testing

Object storage now works fully, with the permission system. It still
needs additional external endpoints for updating and deleting objects
from the API, but it is otherwise complete. Further tasks include
writing an S3 adapter.

prisma/schema.prisma

@@ -18,8 +18,9 @@ model User {
   username String  @unique
   admin    Boolean @default(false)
 
-  email       String
-  displayName String
+  email          String
+  displayName    String
+  profilePicture String // Object
 
   authMecs LinkedAuthMec[]
   clients  Client[]