Keep a guest community logo on review and on the published rule.

Sign-in was clearing the staged file before it uploaded, and review only read the server URL, so a chosen logo disappeared after the upload step.

tests/unit/uploadsPostRoute.test.ts

@@ -80,6 +80,39 @@ describe("POST /api/uploads", () => {
     expect(res.status).toBe(401);
   });
 
+  it("returns 401 when a guest uploads an attachment", async () => {
+    getSessionUserMock.mockResolvedValueOnce(null);
+    const res = await POST(
+      multipartRequest({
+        purpose: "customMethodAttachment",
+        fileName: "notes.pdf",
+        fileContent: "hello",
+        contentType: "application/pdf",
+      }),
+      undefined,
+    );
+    expect(res.status).toBe(401);
+  });
+
+  it("lets a guest submit a community logo and then validates it", async () => {
+    getSessionUserMock.mockResolvedValueOnce(null);
+    const res = await POST(
+      multipartRequest({
+        purpose: "communityAvatar",
+        fileName: "empty.png",
+        fileContent: "",
+      }),
+      undefined,
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as {
+      error: { code: string };
+      details?: { reason?: string };
+    };
+    expect(body.error.code).toBe("validation_error");
+    expect(body.details?.reason).toBe("empty");
+  });
+
   it("returns 500 when UPLOAD_ROOT is unset", async () => {
     getUploadRootFromEnvMock.mockReturnValueOnce(null);
     const res = await POST(