Broadcast profile updates so member lists stay live (no reload needed)

Another user's new display name or avatar didn't show up until you
reloaded -- update_profile/upload_avatar/remove_avatar never told
anyone. Same root cause and fix shape as #26 (room_added): the
frontend's already-fetched member list had no way to hear about a
change, since nothing ever pushed one.

Reuses the existing per-room broadcast channel (not the per-user one
#26 added, since this only matters for rooms the affected user shares
with someone currently looking at them) -- publishes member_updated to
every room the user belongs to; ChatShellPage refetches members when
it arrives for the currently open room.

Verified end-to-end in the browser: one user's room-info member list
updated live when another user changed their display name from a
separate session, no reload.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/services/message_events.py

@@ -117,6 +117,22 @@ async def broadcast_reaction_update(
     # image uploads (see backend/README.md).
 
 
+async def broadcast_member_updated(db: AsyncSession, broadcaster: Broadcaster, user_id: uuid.UUID) -> None:
+    """Tells every room a user belongs to that their displayable info
+    (avatar, display name) changed -- without it, other members' already-
+    fetched member lists (and anything resolving avatar/name from them,
+    like MessageList) go stale until the room is reopened. Only reaches
+    clients that currently have that room's channel joined, which is
+    exactly when a stale avatar would actually be visible on screen."""
+    result = await db.execute(
+        select(RoomMembership.room_id).where(RoomMembership.user_id == user_id)
+    )
+    for (room_id,) in result.all():
+        await broadcaster.publish(
+            room_id, {"type": "member_updated", "room_id": str(room_id), "user_id": str(user_id)}
+        )
+
+
 async def broadcast_room_added(broadcaster: Broadcaster, user_id: uuid.UUID, room: Room) -> None:
     """The only signal a user's open client gets that they were just added
     to a room -- without it, GET /rooms/mine is only ever fetched once at