Fix: constrain image sizes in email notifications

[faisalahammad]

Fixes #3529

Proposed changes:

• Email notifications currently size avatars and post images with CSS only. That CSS is injected mid-body by the embed, and desktop email clients frequently strip or ignore it, so a remote user with a large avatar renders the image at native size and pushes the message off screen.
• Added a global img { max-width: 100%; height: auto; } rule to the shared email header style block so every image in every email template fits the email width.
• Added explicit width/height attributes to the embed avatar (48px) and the new follower icon (64px) so the size holds even when styles are dropped. These match the sizes the existing CSS already enforces, so the public embed output is unchanged.

Other information:

• Have you written new tests for your changes, if applicable?

Logged-in test of email templates can't be automated here, so the fix was verified against the repository CSS and template output. The changes are template and CSS-only with no logic change, so no PHPUnit coverage is added.

Testing instructions:

• Set up a local environment and install the plugin (npm run env-start).
• Receive a direct message or mention from a remote account whose avatar is larger than 48px, and open the resulting email in a client that strips <style> blocks (for example Gmail).
• Confirm the avatar now renders at 48px instead of its native size and the message content stays within the email width.
• Trigger a new follower email from an account with a large icon and confirm the icon is 64px.
• Check a public post with attachments still shows the 48px avatar and full-width preview grid in the embed (regression check).

Changelog entry

• Automatically create a changelog entry from the details below.

A changelog entry was added manually as .github/changelog/fix/3529-avatar-email-max-width.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Fixed oversized avatar and post images in email notifications from remote users. Avatars and inline images now resize to fit the email width instead of overflowing the screen.

[pfefferle]

I am not sure if this pr fixes the issue properly. The report is about a mention, and it shows an avatar that is already around 100% max but this full display size is already too big. I think your PR is a nice improvement, but the issue is still existent!?

[faisalahammad]

@pfefferle thanks for the feedback. I checked the mention path (new-dm and new-mention both render the embed) and found two things that were still missing.

The avatar in templates/embed.php now has inline style="max-width:48px; border-radius:50%;" in addition to the width="48" height="48" attributes. The inline max-width covers clients that strip the style block, so the avatar stays at 48px instead of rendering at native size.

The featured post image in templates/embed.php now has width="600" height="338" and style="max-width:100%;". That is the image that overflows in the screenshot. It now fits the email width in CSS-stripped clients.

I kept height:auto out of the inline styles on purpose. The embed template is also used for the web oEmbed output, and inline height:auto would override the grid object-fit: cover layout there. So the email fix uses the global img { max-width: 100%; } rule plus the explicit dimensions, and the web context is unchanged.

Commit: 0bf2ae5

Would appreciate your review of this follow-up when you have a chance.